I have a High Trust Provider hosted app using the configuration and claims helper from this blog post .
The app can authenticate as app only but when I pass in the user information I get "There was an error: Access denied. You do not have permission to perform this action or access this resource. " The SharePoint logs show that my user is being resolved as the windows user not the SAML user. This is further proven by if I add the windows account the app will authenticate and provide me the user context. What am I doing wrong?
JWT token:
{
"upn": "[email protected]",
"nii": "trusted:adfs",
"aud": "00000003-0000-0ff1-ce00-000000000000/portal.ssolab.local@ab32783d-87a4-4705-ba23-ae2ec8134272",
"iss": "8a7656d9-a909-4304-9c3f-0320b175015e@ab32783d-87a4-4705-ba23-ae2ec8134272",
"exp": "1395592109",
"actortoken": "<decoded below>",
"nbf": "1395591509"
}
{
"upn": "[email protected]",
"identityprovider": "trusted:ADFS",
"iss": "8a7656d9-a909-4304-9c3f-0320b175015e@ab32783d-87a4-4705-ba23-ae2ec8134272",
"smtp": "[email protected]",
"trustedfordelegation": "true",
"exp": "1455591509",
"nameid": "8a7656d9-a909-4304-9c3f-0320b175015e@ab32783d-87a4-4705-ba23-ae2ec8134272",
"nbf": "1395591509",
"aud": "00000003-0000-0ff1-ce00-000000000000/portal.ssolab.local@ab32783d-87a4-4705-ba23-ae2ec8134272"
}
SharePoint Log:
03/23/2014 10:37:45.70 w3wp.exe (0x0B1C) 0x282C SharePoint Foundation Application Authentication ahkpt Medium SPApplicationAuthenticationModule Authentication finished successfully for user:0#.w|ssolab\dpalfery and actor:0i.t|ms.sp.ext|8a7656d9-a909-4304-9c3f-0320b175015e@ab32783d-87a4-4705-ba23-ae2ec8134272 401c809c-043a-2027-b3cc-8517dffcb09a