31

Two HTTP 401 responses is normal when using NTLM authn, that's the way HTTP works. First it tries an anonymous request which generates the first 401 request. The reponse includes a header that says "try with NTLM". Then the NTLM procedure (which is a challenge/response method) requires one 401 and finally a 200. If you want more details here's a good link: ...


21

Answering my own question in case it helps somebody. As mentioned in comment by @SharePointer you need to register an app in Azure AD in order to authenticate against it. That app that you register needs to be given permissions to your SharePoint Online. Login to Azure Portal at https://portal.azure.com that is used by your O365 Tenant where you want to ...


20

In order to consume SharePoint REST service using .NET you could consider the following approaches: HttpClient - Provides a base class for sending HTTP requests and receiving HTTP responses from a resource identified by a URI. (.NET Framework 4.5) WebClient - provides common methods for sending data to and receiving data from a resource identified by a URI. ...


19

You should use SharePointOnlineCredentials that handles all the handshaking, claims and oauth in SharePoint online. using (ClientContext clientContext = new ClientContext("https://innergen.sharepoint.com/sites/mydevsite")) { SecureString passWord = new SecureString(); foreach (char c in "yourpassword".ToCharArray()) passWord.AppendChar(c); ...


14

The big difference with claims based authentication is that you can easily (well it is still SharePoint) add other providers. For example you can add another provider and being able to sign in with your google account, live-id, linkedin account etc etc. Claims-based identity allows you to factor out the authentication logic from individual applications. ...


11

EDIT I have now tried this from within a console application local to my SharePoint VM. I can confirm it works in that environment (both "Created By" and "Modified By" were updated). Let us know if you run into issues using it from within your Windows Service. If I understand your requirement correctly you could most likely update the list item after the ...


9

Ok, there are APIs to support everything you're tyring to do, NEVER DIRECTLY EDIT THE web.config!!!!!!! Follow these easy steps: Package your custom error pages into a solution. Hey, if you're doing the 401 you might want to add a couple of others to support access requests too ;) Deploy the pages to {SP_Root}\Tempates\Layouts\MyErrorPages\ using a ...


8

A couple of things to check for First of all - you do not need delegation yet. Wait with that until you get the log on process to work make sure that the DNS name sharepoint is registered with an A record in DNS (and not a CNAME) register SPN's for both HTTP/sharepoint and HTTP/sharepoint.bkf.internal make sure that the account you use when setting the SPN ...


8

Expanding on what others have written above, in SharePoint 2010 and 2013 it depends on the type of authentication you've setup your Web Application with. For classic mode you only have windows authentication so NT AUTHORITY\authenticated users will grant access to anyone that can authenticate with a valid windows credential. For claims mode you'll have at ...


7

Hope this will help someone because I faced the same issue. The claims based token is refreshed every 10 hours and hence if you make any changes to Active directory group memberships it won't reflect immediately in the token. you need to run the following powershell command to adjust the token life time to a smaller value. $sts = Get-...


7

As the iPad is not a domain device, it doesn't have the capability for cached credentials. The most robust solution I've seen on an iPad uses TMG to handle the authentication component. When the user hits the SharePoint site, they're prompted by TMG for user credentials. TMG then securely processes the authentication and provides the handoff to SharePoint. ...


7

Yes, absolutely. In 2010+, it's the group NT AUTHORITY\authenticated users Before that, it was "All Authenticated Users"


7

The domain that needs to be isolated is only a DNS domain not a new AD domain. This is purely such that you have a separate IIS site where Cross Site Scripting is prevented by the browser. You can add that new domain in DNS (see Configure an environment for apps for SharePoint (SharePoint 2013)) or hosts file. The High trust app still needs the same ...


6

Wictor's answer is an excellent one, but for me the root cause of this issue was IIS' mime-type settings. IE and Firefox will completely adhere to the mime-type sent by the server (the default one being application/octet-stream for IIS) but also will not play a video if the mime-type isn't correct - video/webm, video/ogg or video/mp4. By contrast Google ...


6

In IE (version > 6) SignOut.aspx uses ClearAuthenticationCache as a client side command. This does not work for Firefox. I found this example on StackOverflow that might work for you https://stackoverflow.com/questions/31326/is-there-a-browser-equivalent-to-ies-clearauthenticationcache


6

SharePoint Foundation supports the following types of authentication and the advantage with claim based authentication is that it supports systems that are non Windows based. Windows: IIS and Windows authentication integration options, including Basic, Digest,(NTLM), and Kerberos. Windows authentication allows IIS to perform the authentication for ...


6

Your code needs two changes to work with both SharePoint On-Prem and SharePoint Online. First, change the type of the second parameter from NetworkCredential to ICredentials. Second, you need to add a header value to the request. private static string GetFormDigestValue(string siteurl, ICredentials credentials) { string newFormDigest = ""; ...


5

Try using "\\" before the username when you login to the sharepoint website from client machines.


5

As Kjetil says you need to fix up your SPN's. This is one of the most common errors when setting up Kerberos - not having control of where your SPN's ends up and not having it thorougly documented. Do like this to proceed: Remove the SPN using setspn -D from the account that is NOT the application pool of your web application Restart IIS (or reboot) your ...


5

As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...


5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

In case this helps anyone else (or me in the future) you can do this with: $winAp = new-SPAuthenticationProvider -UseWindowsIntegratedAuthentication $stsAp = Get-SPTrustedIdentityTokenIssuer "YourSTS" Set-SPWebApplication -Identity $webApp -AuthenticationProvider $stsAp, $winAp -Zone "Default"


5

I would start by creating a service principal name for the SQL Server instance. I assume you use a default instance on the default port here: SQL Server Instance: servername\mssqlserver SQL Server service account: domain\sql setspn -S MSSQLSvc/servername:1433 domain\sql setspn -S MSSQLSvc/servername.fully.qualified:1433 domain\sql Notice how it is ...


5

FedAuth Cookie is what is used with Claims Authentication. SharePoint STS will issue the FedAuth Cookie which contains the references to the claims token. Claim tokens are actually stored separately. I believe the ASPXAuth cookie stores the actual user (as SharePoint recognizes them) and whether they are currently authenticated. They work together, and ...


5

If you can add users to the FBA Pack, but you can't login, that means that your SharePoint web application web.config/machine.config membership settings are good, but your SecurityTokenService web.config settings are not. Check your SecurityTokenService web.config membership settings and compare them to your web application web.config/machine.config ...


5

Instead of a network credential, you will need a SharePoint Online Credential: http://msdn.microsoft.com/en-us/library/office/microsoft.sharepoint.client.sharepointonlinecredentials_members(v=office.15).aspx


5

OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth. To achieve my goal I need to use these commands: $auth = New-SPAuthenticationProvider -DisableKerberos:$false New-SPWebApplication -...


5

The problem is the URL format that you are providing to the net use command. Take a look at the PowerShell script here http://www.lieben.nu/numb3rs/?page_id=129 which automates mapping a drive letter. You will see the format of the parameter is like this: \\domain.sharepoint.com@SSL\DavWWWRoot\sites\codesite\example\Shared Documents If you would consider ...


5

I was able to find a solution for this by decompiling the CSOM and watching the exchange via Fiddler. *If someone with 300+ reputation can add a "vNext" tag that would be appreciated. It's really hard to find vNext-specific documentation as-is. Yes, you do have to disable MFA. There is no programmatic way around this for now. Microsoft is planning to (or ...


5

Short answer, no. You don't need it. It's just a super, no bars account that all the rest of the accounts' permissions are designated from. As part of the "best practice" its one of those accounts that Microsoft suggests to set everything up with the least-privileged account security model. AutoSPInstaller is a great tool I still rely on today, but running ...


Only top voted, non community-wiki answers of a minimum length are eligible