共用方式為

使用 OAuth 和 SAML 宣告時發生「401 未經授權」錯誤

  • 適用於: Microsoft SharePoint

徵兆

試想以下情況：

  • 您使用的是使用 Active Directory 同盟服務 （AD FS） 做為伺服器數位中的驗證提供者的安全性判斷提示標記語言 （SAML） 宣告類型。
  • 您使用 Role 或 GroupSID 宣告，將許可權授與伺服器陣列中 Microsoft SharePoint 2013 網站上的使用者。
  • 您的伺服器數位版本早於15.0.4805.1000版（2016年3月累積更新）。

在此案例中，具有透過 Role 或 GroupSID 宣告類型指派適當許可權的使用者，在下列情況下使用 OAuth 驗證方法時，會收到「401 未經授權」錯誤訊息：

  • 工作流程管理員 （SharePoint 2013 工作流程）
  • Web 應用程式隨附 （WAC - Office Web Apps）
  • 高信任或低信任提供者託管的應用程式
  • 跨伺服器數位服務應用程式發佈/取用
  • 混合式 SharePoint 2013/SharePoint Online 案例
  • SharePoint 與 Exchange 和 Lync 2013/商務用 Skype 整合

解決方法

若要解決此問題，請在 伺服器數位中的所有伺服器上安裝 Microsoft SharePoint Server 的 2016 年 3 月累積更新。

在修正中，GroupClaimType 的新屬性會新增至SPTrustedIdentityTokenIssuer物件。 若要讓 OAuth 能夠正確運作，此屬性必須設定為正確的宣告類型，才能讓透過 Role 或 GroupSID 宣告類型指派許可權的用戶獲得授權。

若要設定 GroupClaimType 屬性，請執行下列 Windows PowerShell 命令：

#Create a variable containing the SPTrustedIdentityTokenIssuer object  
$issuer = Get-SPTrustedIdentityTokenIssuer  

#Set the GroupClaimType property to the Role claim type, do not run for GroupSID claim type  
$issuer.GroupClaimType = [Microsoft.IdentityModel.Claims.ClaimTypes]::Role   

#Set the GroupClaimType property to the GroupSID claim type, do not run for Role claim type  
$issuer.GroupClaimType = [Microsoft.IdentityModel.Claims.ClaimTypes]::GroupSid  

#Update the SPTrustedIdenityTokenIssuer object to apply the change   
$issuer.Update()

相關資訊

來自失敗工作流程的錯誤訊息範例：

RequestorId: <Requestor ID>. Details: System.ApplicationException: HTTP 401 {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}} } {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPRequestGuid":["<SP Request GUID>"],"request-id":["<Request ID>"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4805"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1; RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Fri, 19 Aug 2016 20:35:30 GMT"],"Server":["Microsoft-IIS\/8.0"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]} at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance instance, ActivityExecutor executor, BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor executor, BookmarkManager bookmarkManager, Location resultLocation)

整合記錄系統 （ULS） 記錄中的範例記錄專案：

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation CSOM aii1c Verbose Checking   
SPBasePermissions.Open permission  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation Authentication Authorization ajmmu   
Medium Permission check failed. asking for 0x10000, have 0x2000000000 645f0edc-7ec9-44c5-84b7-  
2adfba2f7f92  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation CSOM afxwb High  
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at   
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at   
Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask) at   
Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest() at   
Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1   
pendingDisposableContainer)  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation CSOM agmjp High Original error:  
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at   
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at   
Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask) at   
Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest() at   
Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1   
pendingDisposableContainer)   

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Portal Server Microfeeds aizmo Medium   
SocialRESTExceptionProcessingHandler.DoServerExceptionProcessing - SharePoint Server Exception   
[System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at   
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at   
Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask) at   
Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest() at   
Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1   
pendingDisposableContainer)] 645f0edc-7ec9-44c5-84b7-2adfba2f7f92  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation Claims Authentication af32v Verbose   
Claims Windows Sign-In: Sending 401 for request  
'http://<;servername>;:30079/_vti_bin/client.svc/web/lists/getbyid(guid'<GUID>')' because the request is not from a browser.   

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation Authentication Authorization alkvd   
Medium Throw UnauthorizedAccessException instead of SPUtilityInternal.Send401 for client.svc request.

狀態

Microsoft已確認 SharePoint 伺服器陣列版本中的問題早於 2016 年 3 月累積更新 （v. 15.0.4805.1000）。

參考資料

SharePoint 更新

是否仍需要協助？ 請前往 Microsoft 社群。