403 Forbidden when sharepoint hosted app tries to access OData service

Question

So I've been developing my sharepoint hosted app using my developer account. This has been working great so far. Now before deploying my app I've been doing some tests, one of them is running them as a user with less permissions.

My developer account that works fine is a domain account, db admin, local admin, sharepoint admin etc etc..

My test account is a local account, I've tried making it a local admin, db admin etc.. Nothing made it work. I can login to the website, even to the app in the app web, but the script gets a 403 forbidden error when making an ajax request to:

http://<app web>/<site>/<AppName>/_api/ProjectData/Resources?$filter=ResourceNTAccount eq 'i%3A0%23.w%7Csfdbpp01%5Ctestuser'

Another weird issue is that my loading gif doesn't even move when using my local account + internet explorer (works fine in other browsers).

Does anybody have any idea what I'm missing, that causes this strange behaviour?

Answer 1

In the meantime I've found the solution myself, by default in project server, only Administrators, Portfolio Managers and Portfolio viewers have the rights to access the reporting service. This option has to be enabled manually for other usergroups, at PWA Settings > Manage Groups > [Group name] > Global Permissions > General > Access Project Server Reporting Service

However, I think it's illogical that users with insufficient rights can access these apps in the first place, since the required permissions are clearly stated in the app manifest.

Answer 2

You should add the needed permission to AppManifest.xml file to be able to retrieve the data you are requesting from the app. (http://msdn.microsoft.com/en-us/library/office/fp142383%28v=office.15%29.aspx)