ServerUnauthorizedAccessException

[ivoloshin]

Hello,

We've followed the multitude of online articles, code examples and help comments and even worked with MSDN support and are still having difficulty setting this up. Your code seems like it should be functioning, however, we seem to get the following error for all users except for one.

ServerUnauthorizedAccessException: Access denied. You do not have permission to perform this action or access this resource.

Do you think you could shed some light on what may be causing this? We basically have a ADFS server with a realm for SharePoint and one for a SharePoint trusted app. We want the app to login and access SharePoint API using the SAML credentials. Like I said, the weird thing is that this works for one user, but we cannot tell what the difference is between that account that the ones that do not work.

Thank you,
Ilya

[wictorwilen]

When do you get this exception? A stack trace would help a lot. Also, is this exception when communicating with SharePoint? If so check the SharePoint trace logs.

[ivoloshin]

Well, we basically get 401 Unauthorized on the ExecuteQuery() call when we create a SharePoint context in c# in our provider hosted app and try to execute any query. Here are couple of things that are strange:

1. We added my ADFS Claims account to the host web.
2. I can log in to the host web no problem. It authenticates me against ADFS.
3. I can log into our provider hosted app no problem. It authenticates me against ADFS.
4. I try to run query against SharePoint, I get 401 Unauthorized error.
5. We added my Windows account to the host web as well.
6. Now it works for my account.

So, now we tried to reproduce the same thing with another new ADFS account. We added both ADFS claims and Windows accounts to host web. This account still gets 401 Unauthorized when performing a query against Sharepoint API.

Also, this is using SMTP claims. If I use UPN claim, then I get 401 Unauthorized as well. Regardless if I have the Windows account added to the host web or not.

I looked at the tokens being sent to SharePoint and they look like they have all the same information (except for the user, of course) when we make the SharePoint API call, but for some reason SharePoint still cannot validate that it's a user that has permissions.

This seems like a configuration issue but we don't even know where to look.

[ivoloshin]

I think this basically describes our problem: https://ldapcp.codeplex.com/workitem/1923
Somehow some of our accounts are configured correctly while others aren't and we're not sure why.

[wictorwilen]

Take a look at the SharePoint trace logs. Bump up Claims logging to Verbose.

[raghuureddy]

Hi Wictor,

I have heard a lot about you :)

I am facing an issue on provider hosted app with ADFS.

Session gets created & everything seems to be fine, except it throws 405.

HTTP Error 405.0 - Method Not Allowed
The page you are looking for cannot be displayed because an invalid method (HTTP verb) is being used.

Detailed Error Information:
Module DirectoryListingModule
Notification ExecuteRequestHandler
Handler StaticFile
Error Code 0x80070001
Requested URL https://appurl.domain.org:443/
Physical Path D:\inetpub\wwwroot\wwwspadfs
Logon Method Anonymous
Logon User Anonymous
Request Tracing Directory C:\inetpub\logs\FailedReqLogFiles

Can you please guide me on this?

Thanks,
Raghu