The remote server returned an error: (401) Unauthorized - Provider hosted App

Question

I am trying to access an web application through provider hosted App. In the webapplication, at clientContext.ExecuteQuery(); I am getting 'The remote server returned an error: (401) Unauthorized'. Following unxpected error is recorded in uls logs

SPApplicationAuthenticationModule: Failed to authenticate request, unknown error. Exception details: System.IdentityModel.Tokens.SecurityTokenException: The issuer claim of the user identity doesn't match the nameid (name identifier) claim of the delegated identity (actor identity). It is expected that these two claims match and hence this token is rejected. at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityBaseTokenHandler.ValidateActorIsSelfIssuer(SecurityToken token, ClaimsIdentityCollection result) at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityBaseTokenHandler.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityTokenHandler.ValidateToken(SecurityToken token) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.TryExtractAndValidateToken(HttpContext httpContext, SPIncomingTokenContext& tokenContext) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.ConstructIClaimsPrincipalAndSetThreadIdentity(HttpApplication httpApplication, HttpContext httpContext, SPFederationAuthenticationModule fam) at Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModule.AuthenticateRequest(Object sender, EventArgs e)

Any help would be greatful.

Answer 1

I restarted my box & started the whole configuration again. This time it worked. Steps that are redone -

1. Created new self signed certificate.
2. Registered it with SharePoint using the following PS Commands $publicCertPath = "c:\certificates\SampleCert.cer" $issuerId = [System.Guid]::NewGuid().ToString() $issuerId $spurl ="http://hostname/sites/sitecoll" $spweb = Get-SPWeb $spurl $realm = Get-SPAuthenticationRealm -ServiceContext $spweb.Site $certificate = ***New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($publicCertPath)*** New-SPTrustedRootAuthority -Name "SampleCert" -Certificate $certificate $fullIssuerIdentifier = $issuerId + '@' + $realm New-SPTrustedSecurityTokenIssuer -Name $issuerId -Certificate $certificate -RegisteredIssuerName $fullIssuerIdentifier -IsTrustBroker
3. Used http://hostname/_layouts/15/appregnew.aspx to register the App with SharePoint
4. Used the generated Appid as ClientId, AppSecret as ClientSecret and IssuerId from 2nd step.

I guess restarting the box has fixed my issue as I haven't done anthing different. View at Microsoft Docs: https://docs.microsoft.com/pt-br/sharepoint/dev/sp-add-ins/create-high-trust-sharepoint-add-ins