search

SharePoint / sp-dev-docs

SharePoint & Viva Connections Developer Documentation
https://docs.microsoft.com/en-us/sharepoint/dev/
Creative Commons Attribution 4.0 International
1.24k stars 1.01k forks source link

Is that 'Sites. Selected' permissions level allows the SharePoint online global search? #8805

Open Harmeet94Singh opened 1 year ago

Harmeet94Singh commented 1 year ago

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

None

What browser(s) / client(s) have you tested

Additional environment details

[- browser version

Describe the bug / error

I want to execute SharePoint search API with granular access for that I've changed 'Sites.ReadWrite.All' permission to 'Sites.Selected' permission, so that application would have all sites access but during search I'm getting unauthorize error

{"odata.error":{"code":"-1, Microsoft.Office.Server.Search.REST.SearchServiceException","message":{"lang":"en-US","value":"Unauthorized."}}}

Also tried to give sites.selected permission at tenant level, that also not works, if the only solution is to give 'Sites.ReadWrite.All' or 'Sites.Read' then there is no use of granular level access implementation Sites.Read.all will allow all sites if granted.

My query is similar to below -: [https://tenant.sharepoint.com/_api/search/query?querytext='*+AND+(Path](https://tenant.sharepoint.com/_api/search/query?querytext=%27*+AND+(Path):"https://tenant.sharepoint.com/sites/SITE1/RECORDS" OR Path:"https://tenant.sharepoint.com/sites/SITE2/RECORDS")'&trimDuplicates=false&selectProperties='Column1,Column2'&refiners='Column1OWSTEXT'&refinementFilters='Column1:equals(\"xxxxx\")'&rowLimit=5

Some other references regarding my question. https://sharepoint.stackexchange.com/questions/306397/how-to-use-sharepoint-search-query-with-sharep... https://sharepoint.stackexchange.com/questions/306432/is-that-sites-selected-permissions-level-allow...

https://techcommunity.microsoft.com/t5/sharepoint-developer/how-to-use-sharepoint-search-query-with-sharepoint-granular/m-p/3751381#M12271

Really appreciate any response on this or alternative approach to to achieve this.

Steps to reproduce

We have an Azure function that queries/creates/updates SPO DocumentLibraries. We earlier had 'Sites.ReadWrite.All' and 'Files.ReadWrite.All' permission to the Azure function service-prinicpal (SP), and as part of best practices switched it to 'Sites.Selected' permission. With this new configuration the creates/updates are working, however the SharePoint search query api's (_api/search/query) is failing. Doesn't the 'Sites.Selected' configuration work for search query api's? Is provisioning 'Sites.Read.All' only available alternative? (Which makes the app less secure).

Note: The search query is limited to specific documentLibraries by using path filter, these are configured as part of 'Sites.Selected' configuration.

https://tenant.sharepoint.com/_api/search/query?querytext='*+AND+(Path:"https://tenant.sharepoint.com/sites/SITE1/RECORDS" OR Path:"https://tenant.sharepoint.com/sites/SITE2/RECORDS")'&trimDuplicates=false&selectProperties='Column1,Column2'&refiners='Column1OWSTEXT'&refinementFilters='Column1:equals(\"xxxxx\")'&rowLimit=5 Updated 21/02: With 'sites.Selected' the search queries are throwing 'unauthorized exception'.

Expected behavior

With sites.selected , it should allow the search which is not working currently.

ghost commented 1 year ago

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

smolattack commented 1 year ago

As far as I know, apps can't use SharePoint search (because there is no user context). https://github.com/SharePoint/sp-dev-docs/issues/8436

You would need to use the graph API in your backend scenario https://learn.microsoft.com/en-us/graph/search-concept-files

Harmeet94Singh commented 1 year ago

We are already using SharePoint API's , it is working fine it is failing only this scenario when we are doing search https://tenant.sharepoint.com/_api/search/query?querytext='*+AND+(Path:"https://tenant.sharepoint.com/sites/SITE1/RECORDS" OR Path:"https://tenant.sharepoint.com/sites/SITE2/RECORDS")'&trimDuplicates=false&selectProperties='Column1,Column2'&refiners='Column1OWSTEXT'&refinementFilters='Column1:equals(\"xxxxx\")'&rowLimit=5

OR

https://tenant.sharepoint.com/sites/site2/_api/search/query?querytext='*'

Harmeet94Singh commented 1 year ago

any update please

sarus commented 9 months ago

Just wanted to add that I'm trying the same or very similar setup and running into the same/similar issue.

We have an Azure App with the Sharepoint.Sites.Selected Application permission applied and when we try to use the SharePoint Search API (_api/search/query) endpoint the request fails with:

    body: {
      "odata.error": {
        "code": "-1, Microsoft.Office.Server.Search.REST.SearchServiceException",
        "message": {
          "lang": "en-US",
          "value": "No User or App Context found"
        }
      }
    }

Other REST API calls to the selected site work (e.g., to _api/web/lists/GetByTitle.

As a concrete example, a REST API call using the following parameters fails:

// Failing call
{
   uri: "https://{{tenant}}.sharepoint.com/sites/{{siteName}}/_api/search/query?querytext='sharepoint'",
   method: 'GET',
   headers: {
     Authorization: "Bearer " + token
   },
   json: true
}

Here {{tenant}} is our tenant name, and {{siteName}} is the name of the site we've given our app access to via the MS Graph API.

Using the same token on the same site however works when making this call:

// Successful call
{
   uri: "https://{{tenant}}.sharepoint.com/sites/{{siteName}}/_api/web/lists/GetByTitle('Documents')",
   method: 'GET',
   headers: {
     Authorization: "Bearer " + token
   },
   json: true
}

If I revoke the permission via the Graph API, then the above call starts returning a 403 as expected.

It almost seems like Sharepoint.Sites.Selected doesn't work with the search API but I haven't been able to find anything definitive saying whether this is expected or a bug. We're using Application permissions with certificate authentication. The search API call works fine if we switch permissions to Sharepoint.Sites.Read.All but this is not something we can do in production.

Here are the general instructions we've followed: https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins-modernize/understanding-rsc-for-msgraph-and-sharepoint-online

In addition, we tested with the graph API rather than the Sharepoint API and we run into the same issue (Graph API calls except for search/query work).

DeLuca-Marco commented 6 months ago

I am struggling with the same issue. We cannot grant Sites.Read.All. Therefore we use Sites.Selected. But in this case I receive: "No User or App Context found".

kumaranupam21 commented 3 months ago

It's been more than a year without any update on this topic.

This should be categorized as a bug, because Sites.Selected is essentially a SCOPE and NOT the permission itself.

We have a selection of Sites where the App has Full Control and just the search doesn't work. It shouldn't throw "No User or App Context found" error since there is no user context even when we change the permission from Sites.Selected to Sites.Read.All.