29

Answering my own question in case it helps somebody. As mentioned in comment by @SharePointer you need to register an app in Azure AD in order to authenticate against it. That app that you register needs to be given permissions to your SharePoint Online. Login to Azure Portal at https://portal.azure.com that is used by your O365 Tenant where you want to ...


21

You should use SharePointOnlineCredentials that handles all the handshaking, claims and oauth in SharePoint online. using (ClientContext clientContext = new ClientContext("https://innergen.sharepoint.com/sites/mydevsite")) { SecureString passWord = new SecureString(); foreach (char c in "yourpassword".ToCharArray()) passWord.AppendChar(c); ...


21

In order to consume SharePoint REST service using .NET you could consider the following approaches: HttpClient - Provides a base class for sending HTTP requests and receiving HTTP responses from a resource identified by a URI. (.NET Framework 4.5) WebClient - provides common methods for sending data to and receiving data from a resource identified by a URI. ...


14

The big difference with claims based authentication is that you can easily (well it is still SharePoint) add other providers. For example you can add another provider and being able to sign in with your google account, live-id, linkedin account etc etc. Claims-based identity allows you to factor out the authentication logic from individual applications. ...


7

The domain that needs to be isolated is only a DNS domain not a new AD domain. This is purely such that you have a separate IIS site where Cross Site Scripting is prevented by the browser. You can add that new domain in DNS (see Configure an environment for apps for SharePoint (SharePoint 2013)) or hosts file. The High trust app still needs the same ...


7

Just adding this here since the Azure Portal is slightly different now. Login to Azure Portal at https://portal.azure.com for your O365 Tenant Either use the Search at the top of the page for App registrations or Select All Services > Scroll down to Identity and Select App registrations Select New Registration Give it a name, Change the account type to ...


7

I've successfully achieved it using this tutorial. Sharepoint configuration part Register a new app by following https://YourTenant.sharepoint.com/_layouts/15/appregnew.aspx link generating Client Id and ** Client Secret** values filling Title, App Domain and Redirect URI fields (I've input localhost.com as on the picture - it works) clicking Create button ...


6

FedAuth Cookie is what is used with Claims Authentication. SharePoint STS will issue the FedAuth Cookie which contains the references to the claims token. Claim tokens are actually stored separately. I believe the ASPXAuth cookie stores the actual user (as SharePoint recognizes them) and whether they are currently authenticated. They work together, and ...


6

SharePoint Foundation supports the following types of authentication and the advantage with claim based authentication is that it supports systems that are non Windows based. Windows: IIS and Windows authentication integration options, including Basic, Digest,(NTLM), and Kerberos. Windows authentication allows IIS to perform the authentication for ...


6

Your code needs two changes to work with both SharePoint On-Prem and SharePoint Online. First, change the type of the second parameter from NetworkCredential to ICredentials. Second, you need to add a header value to the request. private static string GetFormDigestValue(string siteurl, ICredentials credentials) { string newFormDigest = ""; ...


5

If you can add users to the FBA Pack, but you can't login, that means that your SharePoint web application web.config/machine.config membership settings are good, but your SecurityTokenService web.config settings are not. Check your SecurityTokenService web.config membership settings and compare them to your web application web.config/machine.config ...


5

Instead of a network credential, you will need a SharePoint Online Credential: http://msdn.microsoft.com/en-us/library/office/microsoft.sharepoint.client.sharepointonlinecredentials_members(v=office.15).aspx


5

OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth. To achieve my goal I need to use these commands: $auth = New-SPAuthenticationProvider -DisableKerberos:$false New-SPWebApplication -...


5

The problem is the URL format that you are providing to the net use command. Take a look at the PowerShell script here http://www.lieben.nu/numb3rs/?page_id=129 which automates mapping a drive letter. You will see the format of the parameter is like this: \\domain.sharepoint.com@SSL\DavWWWRoot\sites\codesite\example\Shared Documents If you would consider ...


5

I was able to find a solution for this by decompiling the CSOM and watching the exchange via Fiddler. *If someone with 300+ reputation can add a "vNext" tag that would be appreciated. It's really hard to find vNext-specific documentation as-is. Yes, you do have to disable MFA. There is no programmatic way around this for now. Microsoft is planning to (or ...


5

Short answer, no. You don't need it. It's just a super, no bars account that all the rest of the accounts' permissions are designated from. As part of the "best practice" its one of those accounts that Microsoft suggests to set everything up with the least-privileged account security model. AutoSPInstaller is a great tool I still rely on today, but ...


5

Multiple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted Apps. $tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com $tit.UseWReplyParameter = $true $tit.Update() Please see the following blog: SharePoint and ADFS with SharePoint Hosted apps


5

Just regenerate the token. Add the App For SharePoint nuget package to your console app. Install-Package AppForSharePointWebToolkit Then write the code to generate the token and context object. Uri siteUri = new Uri(siteUrl); string realm = TokenHelper.GetRealmFromTargetUrl(siteUri); string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper....


5

I don't think it's possible to use digest or basic in Online. From my perspective, you have different possible solution depending on your requirements. From my POV there are three options available: Since you need user context, the easiest way for you is to create Azure AD application and use OAuth in order to obtain access token. You need to get ...


5

Try this solution: HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Identity Check if EnableADAL key is present If not present then create new REG_DWORD key with name EnableADAL and value 0 This worked for me


5

Make sure that The image is not checked-out, try to upload it again as a new version and check it in. The library/folder that holds the image doesn't have a unique permission. The image itself doesn't have a unique permission.


4

Download Fiddler and Run it. Fire up your IE and open the SharePoint site in the browser. Now go back to Fiddler and see the traces. Click on the trace with a HTTP Response headers pane in the left. If Kerberos is working "Cookies / Login" will show Authorization:Negotiate. A detailed walkthrough is here This ofcourse goes with the assumption, that you do ...


4

NTLM is not supported for SharePoint online. You have to use the OData API which requires OAuth authentication. Out of the box, SSIS will not support this and you will have to write CLR code if you are going to try.


4

if you are trying to run it using network credential try the below code clientContext.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials; Also try adding headers context.ExecutingWebRequest += clientContext_ExecutingWebRequest; static void clientContext_ExecutingWebRequest(object sender, WebRequestEventArgs e) { try ...


4

to use javascript you need to send a post request to a webservice, the url should look like this: /_vti_bin/authentication.asmx to read up on javascript post event read up here: http://api.jquery.com/jQuery.post/ the syntax is: $.ajax({ type: "POST", url: url, data: data, success: success, dataType: dataType}); so from the above we ...


4

The sp_install user should only be used to execute the base/initial installation of SharePoint. The sp_farm account is used after the setup in the SharePoint Configuration Wizard. And after that all Services should run under SP_Farm Account as expected. I don't know if you can separate the accounts in the AutoSPInstaller but i am sure it will be ok to only ...


4

When using high trust, you are using the same JWT tokens. The difference is that in high trust system, your app is so cool and so trusted, that SharePoint trusts your app for token generation. Actually your app generates and signs tokens. That's why this system called high trust (compare to low-trust, when SharePoint have to trust third-party Azure ACS). ...


4

For that purpose I would strongly recommend you to use PnP AuthenticationManager class, which already contains methods for obtaining ClientContext with different authentication mechanism. For example for your requirements there are public ClientContext GetADFSUserNameMixedAuthenticatedContext public ClientContext GetNetworkCredentialAuthenticatedContext ...


4

And, here's an update: KB3203432 - https://support.microsoft.com/en-us/help/3203432/descriptionofthesecurityupdateforsharepointserver2016june13-2017 did seem to fix this problem (the 401 vs 403 issue) without using the module above. However, it then created another problem for us in our on-premises SP 2016 system with Office 2016 (and claims auth via AD ...


4

Here is a demo for your reference, We access SharePoint online and use REST API to upload a file in JAVA. 1.Get the security token from Microsoft authentication portal: public String receiveSecurityToken() throws TransformerException, URISyntaxException { RequestEntity<String> requestEntity = new RequestEntity<>(...


Only top voted, non community-wiki answers of a minimum length are eligible