Token request failed error when getting app only access token

-

Recently I started seeing token request failed error in my job and my provider hosted app.   The jobs and provided hosted apps have been working well for a long time and it just suddenly happened.  They always failed at TokenHelper.getAppOnlyAccessToken method.

Error info:

Type: System.Net.WebException

Message: Token request failed.

After digging around, it looks like there are a few updates on Microsoft to SharePoint, Azure, and AAD.  You can see more details from here, https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/provider-hosted-app-pha-application-errors-tls-errors-and-401/ba-p/2273611.

Essentially, here are the 2 solution depending where is your code located:

  • If you're running your jobs or web applications on a server, you can apply the change to update the TLS and cipher used.  See the details for the TLS/Cipher changes in the link above.
  • If you're hosting the provided hosted app in Azure web app, you can update your code instead.  You can add ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 to your code before you get the AppOnly access token.
Sample code:


public ClientContext GetAppContext() 
{
    ServicePointManager.SecurityPortocol = SecurityProtocolType.Tls12;
    Uri siteUri = new Uri(_sharepointUrl);    
    string realm = TokenHelper.GetRealmFromTargetUrl(siteUri);

    string accessToken = TokenHelper.GetAppOnlyAccessToken(
        TokeHelper.SharePointPrincipal, 
        siteUri.Authority, realm).AccessToken;

    return TokenHelper.GetClientContextWithAccessToken(siteUri.ToString(), accessToken);
}

after I added the yellow highlighted line, it started working on Azure web app.  That force the code to use TLS 1.2.

Comments

Post a Comment

Popular posts from this blog

SharePoint 2013 - Working with Display Template for Content Search Web Part

-
Image
To create a custom display template, the best approach is to copy an existing one from Out-Of-Box display templates.  You can try each one and find the one that is closest to what you want to do. All the display templates are in the master page gallery.  To access it, Site Settings -> Master pages and page layouts -> Display Templates The Content Web Parts folder contains the display templates for content search web part and Search folder contains the display templates for the search results web parts. The easiest way to take a look at the display templates is to open the list in windows explorer.  On the ribbon, click on Open with Explorer option. You'll see a lot of html and js files in Content Web Parts folder.  The HTML files are the ones that you'll need to take a look.  The .js files are auto-generated when you add a new HTML file or update an existing one. For every content search web part, you usually have to specify two display tem...
Read more

Add spell check dictionary in SharePoint 2010, SharePoint 2013, and Office 365

-
I was looking for how to add custom spell check dictionary in SharePoint 2013 and I found this blog that describes it, http://softlanding.ca/blog/adding-words-to-the-sharepoint-spell-checker-dictionary-(sharepoint-2013-2010). Here is the summary steps in case the above link doesn't work any more. At the root level of your site create a document library called " Spelling " (make sure to name the document library exactly as listed here) On your desktop create a new text file called " Custom Dictionary ", so that the file name looks like " Custom Dictionary.txt " (make sure to spell the file name exactly as listed here) Open the " Custom Dictionary " text file and in this file type in the words you would like NOT to be considered misspelled words (please note that the words are case sensitive so I would have a separate entry for Softlanding and softlanding, and also please make sure each word is listed on a new line) Upload the " C...
Read more

SharePoint 2013 Domain Certificate for Provider-Host App Development Environment

-
Creating Self-Signed (domain) Certificate for Provider-Hosted App This is the certificate that will be used on the IIS site to make it SSL enabled site.  It’s different from the one to create the STS Security token.  If the certificate is not created with proper domain associated, you’ll have issues with calling the App Event Receivers.  To create the certificate and set it up on IIS, following the instruction below: Open Visual Studio Developer Command Prompt and type the following command makecert -r -pe -n "CN= spapps.rchen.com " -b 01/01/2013 -e 01/11/2015 -eku 1.3.6.1.5.5.7.3.1 -ss my -sr localMachine -sky exchange -sy 12 -sp "Microsoft RSA SChannel Cryptographic Provider" " D:\ Certs\SPAppCert.cer " certmgr /add " D:\ Certs\SPAppCert.cer " /s /r localMachine root *** You need to replace the domain ( spapps.rchen.com ) with your domain and the file path for the new certificate. Open MMC.exe and add C...
Read more