使用 OAuth 和 SAML 声明时出现"401 未授权"错误

症状

请考虑以下情况:

  • 你将使用安全声明标记语言 (SAML) 声明类型,这些声明类型使用 Active Directory 联合服务 (AD FS) 作为服务器场中的身份验证提供程序。
  • 使用 Role 或 GroupSID 声明向服务器场中 Microsoft SharePoint 2013 网站的用户授予权限。
  • 您的服务器场版本早于 2016 年 3 月累积 (15.0.4805.1000) 。

在此方案中,通过 Role 或 GroupSID 声明类型为其分配适当权限的用户在以下情况使用 OAuth 身份验证方法时会收到"401 未授权"错误消息:

  • 工作流管理器 (SharePoint 2013 工作流)
  • Web 应用程序助理 (WAC - Office Web 应用)
  • 高信任或低信任提供程序托管的应用程序
  • 跨服务器场服务应用程序发布/使用
  • 混合SharePoint 2013/SharePoint Online 方案
  • SharePoint与 Exchange Lync 2013/Skype for Business

解决方案

若要解决此问题,请为服务器场中所有服务器上安装 Microsoft SharePoint Server 2016年 3 月累积更新。

作为修复的一部分,新的属性 GroupClaimType 将添加到 SPTrustedIdentityTokenIssuer 对象。 若要使 OAuth 能够正常工作,必须为通过 Role 或 GroupSID 声明类型分配权限的用户将此属性设置为正确的声明类型进行授权。

若要设置 GroupClaimType 属性,请运行以下Windows PowerShell命令:

#Create a variable containing the SPTrustedIdentityTokenIssuer object  
$issuer = Get-SPTrustedIdentityTokenIssuer  

#Set the GroupClaimType property to the Role claim type, do not run for GroupSID claim type  
$issuer.GroupClaimType = [Microsoft.IdentityModel.Claims.ClaimTypes]::Role   

#Set the GroupClaimType property to the GroupSID claim type, do not run for Role claim type  
$issuer.GroupClaimType = [Microsoft.IdentityModel.Claims.ClaimTypes]::GroupSid  

#Update the SPTrustedIdenityTokenIssuer object to apply the change   
$issuer.Update()   

更多信息

失败的工作流中的错误消息示例:

RequestorId: <Requestor ID>. Details: System.ApplicationException: HTTP 401 {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}} } {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPRequestGuid":["<SP Request GUID>"],"request-id":["<Request ID>"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4805"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1; RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Fri, 19 Aug 2016 20:35:30 GMT"],"Server":["Microsoft-IIS\/8.0"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]} at Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) at System.Activities.CodeActivity.InternalExecute(ActivityInstance instance, ActivityExecutor executor, BookmarkManager bookmarkManager) at System.Activities.Runtime.ActivityExecutor.ExecuteActivityWorkItem.ExecuteBody(ActivityExecutor executor, BookmarkManager bookmarkManager, Location resultLocation)

统一日志记录系统中 ULS (日志) 条目:

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation CSOM aii1c Verbose Checking   
SPBasePermissions.Open permission  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation Authentication Authorization ajmmu   
Medium Permission check failed. asking for 0x10000, have 0x2000000000 645f0edc-7ec9-44c5-84b7-  
2adfba2f7f92  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation CSOM afxwb High  
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at   
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at   
Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask) at   
Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest() at   
Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1   
pendingDisposableContainer)  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation CSOM agmjp High Original error:  
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at   
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at   
Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask) at   
Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest() at   
Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1   
pendingDisposableContainer)   

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Portal Server Microfeeds aizmo Medium   
SocialRESTExceptionProcessingHandler.DoServerExceptionProcessing - SharePoint Server Exception   
[System.UnauthorizedAccessException: Attempted to perform an unauthorized operation. at   
Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at   
Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask) at   
Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest() at   
Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1   
pendingDisposableContainer)] 645f0edc-7ec9-44c5-84b7-2adfba2f7f92  

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation Claims Authentication af32v Verbose   
Claims Windows Sign-In: Sending 401 for request  
'http://<;servername>;:30079/_vti_bin/client.svc/web/lists/getbyid(guid'<GUID>')' because the request is not from a browser.   

15:54:30.25 w3wp.exe (0x9FCC) 0x5F78 SharePoint Foundation Authentication Authorization alkvd   
Medium Throw UnauthorizedAccessException instead of SPUtilityInternal.Send401 for client.svc request.      

状态

Microsoft 已确认这是早于 2016 年 3 月 SharePoint 2016 年 3 月累积更新版本 (问题。 15.0.4805.1000) 。

参考

SharePoint Updates

仍然需要帮助? 请转到 SharePoint 社区