Guest Users cannot access SharePoint data using REST

Question

Guest Users cannot access SharePoint data using REST

Ruchi Singh 1

Hi,

I am using REST apis to access SharePoint data by Guest users outside of SharePoint, but getting the exception - Microsoft.IdentityModel.Tokens.AudienceUriValidationFailedException.

Please help me to resolve this.

Thanks

Baker Kong-MSFT 3,801 Reputation points

2020-12-09T01:26:38.63+00:00

Hi @Ruchi Singh ,

May I know how you perform the Auth flow? And what's the resource/scope? Can you share one example access token? It's great if you can share the background info.

Best Regards,
Baker Kong
Ruchi Singh 1 Reputation point

2020-12-09T07:42:58.157+00:00

Hi Baker,

Thanks for looking into this.
We are using an external android/iOS application, wherein we are fetching data from SharePoint using REST services and displaying data. Its working fine for normal users, whereas creating issues in case of guest accounts.

Auth Flow: Using Msal :OAuth 2 client credentials flow (https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow)

Scope: https://duerr.sharepoint.com/AllSites.Read

Please let me know in case of any further queries.

Thanks for your support.
Baker Kong-MSFT 3,801 Reputation points

2020-12-09T09:05:55.237+00:00

Hi RuchiSingh-5402,

Per my experience, client credentials flow does not require user interaction. Can you decode the access token to check what the aud it's?

Thanks
Baker Kong
Dattatray Patil 86 Reputation points

2020-12-09T13:16:02.977+00:00

Is it feasible to provide read-only access to the guest account, if you provide read-only access this issue will be get resolved.
Ruchi Singh 1 Reputation point

2020-12-17T06:47:00.113+00:00

Read only access is already given to the user. It is not able to call the REST apis which gets the user profile, from Postman and getting exception.
Ruchi Singh 1 Reputation point

2020-12-22T08:06:12.947+00:00

"aud": "https://duerr.sharepoint.com", "iss": "https://sts.windows.net/05618731-f84d-4a71-aad8-940580e4adf0/", "iat": 1608623882, "nbf": 1608623882, "exp": 1608627782, "acr": "1", "acrs": [ "urn:user:registersecurityinfo", "urn:microsoft:req1", "urn:microsoft:req2", "urn:microsoft:req3", "c1", "c2", "c3", "c4", "c5", "c6" ]
Thomas Maréchal 1 Reputation point

2021-03-22T13:19:30.697+00:00

Hi @Ruchi Singh ,

We are facing the same issue here. Did you receive or find any response to your question ?
Have you been able to allow Guest user to access Sharepoint sites trough the API ?
It is not clear whether this is allowed or not...

Many thanks for your help.
Regards
Thomas
Matt Thesing 6 Reputation points

2022-08-31T05:23:09.487+00:00

Did anyone figure out what was needed to make API calls from a guest account?

I think I have the same issue. I am using a guest account to access files in a SharePoint site and have no problems using the web client to browse and download. If I use the same credentials and attempt to connect to the site via the Microsoft.SharePoint.Client library (C#) I am getting a 403 Forbidden response.

Thanks-
Matt