31

Answering my own question in case it helps somebody. As mentioned in comment by @SharePointer you need to register an app in Azure AD in order to authenticate against it. That app that you register needs to be given permissions to your SharePoint Online. Login to Azure Portal at https://portal.azure.com that is used by your O365 Tenant where you want to ...


21

In order to consume SharePoint REST service using .NET you could consider the following approaches: HttpClient - Provides a base class for sending HTTP requests and receiving HTTP responses from a resource identified by a URI. (.NET Framework 4.5) WebClient - provides common methods for sending data to and receiving data from a resource identified by a URI. ...


14

The big difference with claims based authentication is that you can easily (well it is still SharePoint) add other providers. For example you can add another provider and being able to sign in with your google account, live-id, linkedin account etc etc. Claims-based identity allows you to factor out the authentication logic from individual applications. ...


10

I've successfully achieved it using this tutorial. Sharepoint configuration part Register a new app by following https://YourTenant.sharepoint.com/_layouts/15/appregnew.aspx link generating Client Id and ** Client Secret** values filling Title, App Domain and Redirect URI fields (I've input localhost.com as on the picture - it works) clicking Create button ...


7

The domain that needs to be isolated is only a DNS domain not a new AD domain. This is purely such that you have a separate IIS site where Cross Site Scripting is prevented by the browser. You can add that new domain in DNS (see Configure an environment for apps for SharePoint (SharePoint 2013)) or hosts file. The High trust app still needs the same ...


7

Just adding this here since the Azure Portal is slightly different now. Login to Azure Portal at https://portal.azure.com for your O365 Tenant Either use the Search at the top of the page for App registrations or Select All Services > Scroll down to Identity and Select App registrations Select New Registration Give it a name, Change the account type to ...


6

SharePoint Foundation supports the following types of authentication and the advantage with claim based authentication is that it supports systems that are non Windows based. Windows: IIS and Windows authentication integration options, including Basic, Digest,(NTLM), and Kerberos. Windows authentication allows IIS to perform the authentication for ...


6

Your code needs two changes to work with both SharePoint On-Prem and SharePoint Online. First, change the type of the second parameter from NetworkCredential to ICredentials. Second, you need to add a header value to the request. private static string GetFormDigestValue(string siteurl, ICredentials credentials) { string newFormDigest = ""; ...


5

Instead of a network credential, you will need a SharePoint Online Credential: http://msdn.microsoft.com/en-us/library/office/microsoft.sharepoint.client.sharepointonlinecredentials_members(v=office.15).aspx


5

OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth. To achieve my goal I need to use these commands: $auth = New-SPAuthenticationProvider -DisableKerberos:$false New-SPWebApplication -...


5

The problem is the URL format that you are providing to the net use command. Take a look at the PowerShell script here http://www.lieben.nu/numb3rs/?page_id=129 which automates mapping a drive letter. You will see the format of the parameter is like this: \\domain.sharepoint.com@SSL\DavWWWRoot\sites\codesite\example\Shared Documents If you would consider ...


5

I was able to find a solution for this by decompiling the CSOM and watching the exchange via Fiddler. *If someone with 300+ reputation can add a "vNext" tag that would be appreciated. It's really hard to find vNext-specific documentation as-is. Yes, you do have to disable MFA. There is no programmatic way around this for now. Microsoft is planning to (or ...


5

Short answer, no. You don't need it. It's just a super, no bars account that all the rest of the accounts' permissions are designated from. As part of the "best practice" its one of those accounts that Microsoft suggests to set everything up with the least-privileged account security model. AutoSPInstaller is a great tool I still rely on today, but ...


5

Multiple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted Apps. $tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com $tit.UseWReplyParameter = $true $tit.Update() Please see the following blog: SharePoint and ADFS with SharePoint Hosted apps


5

Just regenerate the token. Add the App For SharePoint nuget package to your console app. Install-Package AppForSharePointWebToolkit Then write the code to generate the token and context object. Uri siteUri = new Uri(siteUrl); string realm = TokenHelper.GetRealmFromTargetUrl(siteUri); string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper....


5

I don't think it's possible to use digest or basic in Online. From my perspective, you have different possible solution depending on your requirements. From my POV there are three options available: Since you need user context, the easiest way for you is to create Azure AD application and use OAuth in order to obtain access token. You need to get ...


5

Try this solution: HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Identity Check if EnableADAL key is present If not present then create new REG_DWORD key with name EnableADAL and value 0 This worked for me


5

Make sure that The image is not checked-out, try to upload it again as a new version and check it in. The library/folder that holds the image doesn't have a unique permission. The image itself doesn't have a unique permission.


4

if you are trying to run it using network credential try the below code clientContext.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials; Also try adding headers context.ExecutingWebRequest += clientContext_ExecutingWebRequest; static void clientContext_ExecutingWebRequest(object sender, WebRequestEventArgs e) { try ...


4

NTLM is not supported for SharePoint online. You have to use the OData API which requires OAuth authentication. Out of the box, SSIS will not support this and you will have to write CLR code if you are going to try.


4

To the best of my understanding is that not much has changed. SharePoint Online is now looking for SPOIDCRL cookie rather than FedAuth cookie. The FedAuth cookie was used and depended a lot on ADFS. The new SPOIDCRL is now using Azure AD Sync Service.


4

The sp_install user should only be used to execute the base/initial installation of SharePoint. The sp_farm account is used after the setup in the SharePoint Configuration Wizard. And after that all Services should run under SP_Farm Account as expected. I don't know if you can separate the accounts in the AutoSPInstaller but i am sure it will be ok to only ...


4

When using high trust, you are using the same JWT tokens. The difference is that in high trust system, your app is so cool and so trusted, that SharePoint trusts your app for token generation. Actually your app generates and signs tokens. That's why this system called high trust (compare to low-trust, when SharePoint have to trust third-party Azure ACS). ...


4

For that purpose I would strongly recommend you to use PnP AuthenticationManager class, which already contains methods for obtaining ClientContext with different authentication mechanism. For example for your requirements there are public ClientContext GetADFSUserNameMixedAuthenticatedContext public ClientContext GetNetworkCredentialAuthenticatedContext ...


4

And, here's an update: KB3203432 - https://support.microsoft.com/en-us/help/3203432/descriptionofthesecurityupdateforsharepointserver2016june13-2017 did seem to fix this problem (the 401 vs 403 issue) without using the module above. However, it then created another problem for us in our on-premises SP 2016 system with Office 2016 (and claims auth via AD ...


4

Here is a demo for your reference, We access SharePoint online and use REST API to upload a file in JAVA. 1.Get the security token from Microsoft authentication portal: public String receiveSecurityToken() throws TransformerException, URISyntaxException { RequestEntity<String> requestEntity = new RequestEntity<>(...


3

What I believe is the major difference is that with classic mode, you login directly, and if you need to be authenticated to a second server, it's not possible (you need to be logged in to this second server first -> new login screen). You will find that this is still often done but in that case the second connection is done under a different account (with ...


3

If you maintain MySites in another web application you need to know that pictures are stored in a library User photos in My sites Host, reason for which everywhere where User picture needs to appear (e.g. comments, notes) it makes a separate request to the other Web Application. if the site loading pictures is itself anonymous, you would need to enable ...


3

The following example demonstrates how to authenticate SharePoint SOAP Services in SharePoint Online using SharePointOnlineCredentials class : public static CookieContainer GetAuthCookies(Uri webUri, string userName, string password) { var securePassword = new SecureString(); foreach (char c in password) { securePassword.AppendChar(c); } var ...


3

Keep me signed in uses cookies to keep a user signed in...so this is only an issue for users who share their computer with other users. In situations where users are sharing computers it should already be standard policy to log out of any sensitive apps and accounts that shouldn't be accessible to other users... I don't see any real security flaw here. http:...


Only top voted, non community-wiki answers of a minimum length are eligible