Sharepoint 2013 Forms Based Authentication Application Forbidden error 403

Question

I am developing a Provider-hosted application for SharePoint 2013.

I debug this application on a Development Collection with both Windows Authentication and FBA (Form Based Authentication) activated. I can successfully access to this collection with my Windows account or a user stored in SQL Server. Both accounts are administrators of the collection with full control on it.

When I run the application, I get the usual window asking for the authentication mode I want. After being successfully connected with a user (both are working), I get : "The remote server returned an error: (403) Forbidden" on clientContext.ExecuteQuery().

var contextToken = TokenHelper.GetContextTokenFromRequest(Page.Request);
var hostWeb = Page.Request["SPHostUrl"];

using (var clientContext = new ClientContext(hostWeb))
{
   clientContext.Load(clientContext.Web, web => web.Title);
   clientContext.ExecuteQuery();
   Response.Write(clientContext.Web.Title);
}

I should precise that, if I disable the FBA on the collection and only let the Windows authentication, it works like a charm.

What am I doing wrong ? Any idea ?

thanks for helping

Answer 1

    public void Whatevermethod()
    {

        using (SP.ClientContext clientContext = new SP.ClientContext("http://server/collection"))
        {
            //Configure the handler to set FBA mode
            clientContext.ExecutingWebRequest += new EventHandler<SP.WebRequestEventArgs>(ctx_MixedAuthRequest);

            //Use the default mode to execute under the credentials of this process
            clientContext.AuthenticationMode = SP.ClientAuthenticationMode.Default;
            clientContext.Credentials = System.Net.CredentialCache.DefaultCredentials;


            clientContext.ExecuteQuery();
        }
    }

    private void ctx_MixedAuthRequest(object sender, SP.WebRequestEventArgs e)
    {
        try
        {
            //Add the header that tells SharePoint to use FBA
            e.WebRequestExecutor.RequestHeaders.Add("X-FORMS_BASED_AUTH_ACCEPTED", "f");
        }
        catch (Exception ex)
        {
            string error = ex.Message;
        }
    }

Answer 2

var hostWeb = Page.Request["SPHostUrl"];

using (var clientContext = new ClientContext(hostWeb))
{
    clientContext.ExecutingWebRequest += new EventHandler<WebRequestEventArgs>(clientContext_ExecutingWebRequest);
    clientContext.Load(clientContext.Web, web => web.Title);
    clientContext.ExecuteQuery();
    Response.Write(clientContext.Web.Title);
}


static void clientContext_ExecutingWebRequest(object sender, WebRequestEventArgs e)
{
    e.WebRequestExecutor.WebRequest.Headers.Add("X-FORMS_BASED_AUTH_ACCEPTED", "f");
}