search

Zerg00s / XSOM

C# Helper classes for working with SharePoint REST API. Included authentication via ADFS
MIT License
3 stars 5 forks source link

ADFS part is not working #2

Open mhmd2015 opened 3 years ago

mhmd2015 commented 3 years ago

Hi, Really its a great project and it worked with [mytenant].sharepoint.com in Windows Form (NET framework , and Core), also and Blazor, but when I'm using another tenant that is associated with ADFS (PingFederate) not worked. Do you have any idea if some change in the soap format?

But in general this is beautiful.

Zerg00s commented 3 years ago

hi, @mhmd2015, thank you for your message. I was debugging this project with ADFS several years and it used to work, but things might have changed since. There are two potential reasons for this not to work:

  1. The protocol is different.
  2. The Legacy Authentication is disabled.

In order to check how the protocol changed, perhaps you can try to use Fiddler to capture how SharePoint PnP authenticates with your SharePoint Online tenant that's secured by ADFS. If SharePoint PnP PowerShell can authenticate, then, maybe you can see if it's possible to update the code that handles ADFS authentication. If SharePoint PnP can't authenticate by passing login and password, then the issue is most likely with the Legacy authentication that was disabled on the SPO tenant..

In tenants where Legacy authentication is disabled, we won't be able to authenticate by passing login and password in clear text. How to check if legacy authentication is enabled:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
$tenant = Get-SPOTenant
$tenant.LegacyAuthProtocolsEnabled

How to enable legacy authentication:

Connect-SPOService -Url –https://<tenant>-admin.sharepoint.com
Set-SPOTenant –LegacyAuthProtocolsEnabled $true

Note: legacy authentication is considered unsafe.

Now, with the Modern Authentication in SharePoint Online, we are forced to use ADAL or MSAL libraries. They are great, but, unfortunately they cause a login pop-up window to show. So, we can't authenticate unless we enter our login(email) and password in the pop-up window. This is less than ideal for most situations, but there is no workaround for this I know.