27

Answering my own question in case it helps somebody. As mentioned in comment by @SharePointer you need to register an app in Azure AD in order to authenticate against it. That app that you register needs to be given permissions to your SharePoint Online. Login to Azure Portal at https://portal.azure.com that is used by your O365 Tenant where you want to ...


21

You should use SharePointOnlineCredentials that handles all the handshaking, claims and oauth in SharePoint online. using (ClientContext clientContext = new ClientContext("https://innergen.sharepoint.com/sites/mydevsite")) { SecureString passWord = new SecureString(); foreach (char c in "yourpassword".ToCharArray()) passWord.AppendChar(c); ...


21

In order to consume SharePoint REST service using .NET you could consider the following approaches: HttpClient - Provides a base class for sending HTTP requests and receiving HTTP responses from a resource identified by a URI. (.NET Framework 4.5) WebClient - provides common methods for sending data to and receiving data from a resource identified by a URI. ...


14

The big difference with claims based authentication is that you can easily (well it is still SharePoint) add other providers. For example you can add another provider and being able to sign in with your google account, live-id, linkedin account etc etc. Claims-based identity allows you to factor out the authentication logic from individual applications. ...


8

Expanding on what others have written above, in SharePoint 2010 and 2013 it depends on the type of authentication you've setup your Web Application with. For classic mode you only have windows authentication so NT AUTHORITY\authenticated users will grant access to anyone that can authenticate with a valid windows credential. For claims mode you'll have at ...


7

Hope this will help someone because I faced the same issue. The claims based token is refreshed every 10 hours and hence if you make any changes to Active directory group memberships it won't reflect immediately in the token. you need to run the following powershell command to adjust the token life time to a smaller value. $sts = Get-...


7

Yes, absolutely. In 2010+, it's the group NT AUTHORITY\authenticated users Before that, it was "All Authenticated Users"


7

The domain that needs to be isolated is only a DNS domain not a new AD domain. This is purely such that you have a separate IIS site where Cross Site Scripting is prevented by the browser. You can add that new domain in DNS (see Configure an environment for apps for SharePoint (SharePoint 2013)) or hosts file. The High trust app still needs the same ...


6

SharePoint Foundation supports the following types of authentication and the advantage with claim based authentication is that it supports systems that are non Windows based. Windows: IIS and Windows authentication integration options, including Basic, Digest,(NTLM), and Kerberos. Windows authentication allows IIS to perform the authentication for ...


6

Your code needs two changes to work with both SharePoint On-Prem and SharePoint Online. First, change the type of the second parameter from NetworkCredential to ICredentials. Second, you need to add a header value to the request. private static string GetFormDigestValue(string siteurl, ICredentials credentials) { string newFormDigest = ""; ...


6

Just adding this here since the Azure Portal is slightly different now. Login to Azure Portal at https://portal.azure.com for your O365 Tenant Either use the Search at the top of the page for App registrations or Select All Services > Scroll down to Identity and Select App registrations Select New Registration Give it a name, Change the account type to ...


5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

Try using "\\" before the username when you login to the sharepoint website from client machines.


5

In case this helps anyone else (or me in the future) you can do this with: $winAp = new-SPAuthenticationProvider -UseWindowsIntegratedAuthentication $stsAp = Get-SPTrustedIdentityTokenIssuer "YourSTS" Set-SPWebApplication -Identity $webApp -AuthenticationProvider $stsAp, $winAp -Zone "Default"


5

I would start by creating a service principal name for the SQL Server instance. I assume you use a default instance on the default port here: SQL Server Instance: servername\mssqlserver SQL Server service account: domain\sql setspn -S MSSQLSvc/servername:1433 domain\sql setspn -S MSSQLSvc/servername.fully.qualified:1433 domain\sql Notice how it is ...


5

FedAuth Cookie is what is used with Claims Authentication. SharePoint STS will issue the FedAuth Cookie which contains the references to the claims token. Claim tokens are actually stored separately. I believe the ASPXAuth cookie stores the actual user (as SharePoint recognizes them) and whether they are currently authenticated. They work together, and ...


5

If you can add users to the FBA Pack, but you can't login, that means that your SharePoint web application web.config/machine.config membership settings are good, but your SecurityTokenService web.config settings are not. Check your SecurityTokenService web.config membership settings and compare them to your web application web.config/machine.config ...


5

Instead of a network credential, you will need a SharePoint Online Credential: http://msdn.microsoft.com/en-us/library/office/microsoft.sharepoint.client.sharepointonlinecredentials_members(v=office.15).aspx


5

OK, found it. The two parameters -AuthenticationProvider and -AuthenticationMethod are from different worlds, not to be used together. The first one works with claims based auth while the second one with Classic Windows auth. To achieve my goal I need to use these commands: $auth = New-SPAuthenticationProvider -DisableKerberos:$false New-SPWebApplication -...


5

The problem is the URL format that you are providing to the net use command. Take a look at the PowerShell script here http://www.lieben.nu/numb3rs/?page_id=129 which automates mapping a drive letter. You will see the format of the parameter is like this: \\domain.sharepoint.com@SSL\DavWWWRoot\sites\codesite\example\Shared Documents If you would consider ...


5

I was able to find a solution for this by decompiling the CSOM and watching the exchange via Fiddler. *If someone with 300+ reputation can add a "vNext" tag that would be appreciated. It's really hard to find vNext-specific documentation as-is. Yes, you do have to disable MFA. There is no programmatic way around this for now. Microsoft is planning to (or ...


5

Short answer, no. You don't need it. It's just a super, no bars account that all the rest of the accounts' permissions are designated from. As part of the "best practice" its one of those accounts that Microsoft suggests to set everything up with the least-privileged account security model. AutoSPInstaller is a great tool I still rely on today, but ...


5

Multiple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted Apps. $tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com $tit.UseWReplyParameter = $true $tit.Update() Please see the following blog: SharePoint and ADFS with SharePoint Hosted apps


5

Just regenerate the token. Add the App For SharePoint nuget package to your console app. Install-Package AppForSharePointWebToolkit Then write the code to generate the token and context object. Uri siteUri = new Uri(siteUrl); string realm = TokenHelper.GetRealmFromTargetUrl(siteUri); string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper....


5

I don't think it's possible to use digest or basic in Online. From my perspective, you have different possible solution depending on your requirements. From my POV there are three options available: Since you need user context, the easiest way for you is to create Azure AD application and use OAuth in order to obtain access token. You need to get ...


5

Try this solution: HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Identity Check if EnableADAL key is present If not present then create new REG_DWORD key with name EnableADAL and value 0 This worked for me


5

Make sure that The image is not checked-out, try to upload it again as a new version and check it in. The library/folder that holds the image doesn't have a unique permission. The image itself doesn't have a unique permission.


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


4

If you are looking for more security, Basic Authentication is not something you should consider.When using Basic authentication,User name and password are transmitted between the client and server as clear text. So its not secure at all unless you use SSL. In NTLM, the password is never transmitted across the wire and hence it is much more secure then Basic ...


4

Download Fiddler and Run it. Fire up your IE and open the SharePoint site in the browser. Now go back to Fiddler and see the traces. Click on the trace with a HTTP Response headers pane in the left. If Kerberos is working "Cookies / Login" will show Authorization:Negotiate. A detailed walkthrough is here This ofcourse goes with the assumption, that you do ...


Only top voted, non community-wiki answers of a minimum length are eligible