0
votes

I'm following the sample code located at https://nickvandenheuvel.eu/tag/adal-js/ but my code fails with the SharePoint connection with a ADAL Error AADSTS500011.

The error message states "The resource principal named https://my.sharepoint.com/sites/mysite was not found in the tenant named mytenant.onmicrosoft.com. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant."

My code is exactly the same as the article. My thought is maybe something needs to be done with my Azure registration for my SharePoint site, or, the code is outdated with how Office 365 and SharePoint now works.

// Assign variables
var variables = {
  // Domain of Azure AD tenant
  azureAD: "tenantname.onmicrosoft.com",
  // ClientId of Azure AD application principal
  clientId: "11111111-1111-1111-1111-111111111111",
  // GUID of SharePoint list
  listId: "22222222-2222-2222-2222-222222222222",
  // Name of SharePoint tenant
  sharePointTenant: "tenantname"
}

// Create config and get AuthenticationContext
window.config = {
  tenant: variables.azureAD,
  clientId: variables.clientId,
  postLogoutRedirectUri: window.location.origin,
  endpoints: {
    graphApiUri: "https://graph.microsoft.com",
    sharePointUri: "https://" + variables.sharePointTenant + ".sharepoint.com",
  },
  cacheLocation: "localStorage"
};
var authContext = new AuthenticationContext(config);
var user = authContext.getCachedUser();
if (!user) {
  authContext.login();
}
// Get OneDrive documents of current user with AuthenticationContext of Graph API 
authContext.acquireToken(config.endpoints.graphApiUri, function (error, token) {
  if (error || !token) {
    console.log("ADAL error occurred: " + error);
    return;
  }
  else {
    var filesUri = config.endpoints.graphApiUri + "/v1.0/me/drive/root/children";

    $.ajax({
    type: "GET",
    url: filesUri,
    headers: {
      "Authorization": "Bearer " + token
    }
    }).done(function (response) {
      console.log("Successfully fetched files from OneDrive.");
      var items = response.value;
      for (var i = 0; i < items.length; i++){
        console.log(items[i].name);
        $("#OneDrive").append("<li>" + items[i].name + "</li>");
      }
    }).fail(function () {
      console.log("Fetching files from OneDrive failed.");
    });
  }
});
// Get SharePoint documents of list with AuthenticationContext of SharePoint
    authContext.acquireToken(config.endpoints.sharePointUri, function (error, token) {
      if (error || !token) {
        console.log("ADAL error occurred: " + error);
        return;
      }
      else {
        var listUri = config.endpoints.sharePointUri + "/_api/web/lists('" + variables.listId + "')/items?$select=Title";

        $.ajax({
        type: "GET",
        url: listUri,
        headers: {
          "Authorization": "Bearer " + token,
          "accept": "application/json;odata=verbose"
        }
        }).done(function (response) {
          console.log("Successfully fetched list from SharePoint.");
          var items = response.d.results;
          for (var i = 0; i < items.length; i++){
            console.log(items[i].Title);
            $("#SharePoint").append("<li>" + items[i].Title + "</li>");
          }
        }).fail(function () {
          console.log("Fetching list from SharePoint failed.");
        });
      }
    });

I can say that the code does work for the rest API and OneDrive. It also works for getting the user information from Azure AD. The error message only appears when I try to interact with the SharePoint site. I'm not sure if the code isn't up to date with how ADAL interacts with SharePoint, or if there is something in Azure AD that needs to be configured. Since the interaction with OneDrive seems to work I assume Azure AD isn't the issue (since I can't recall having to set anything in Azure AD for OneDrive).

1

1 Answers

0
votes

The error : AADSTS500011 means that your resource name is either wrong. or doesn't exist(meaning your admin hasn't granted consent yet)

i.e. https://my.sharepoint.com/sites/mysite was not find in your tenant's list of SPs. Note that the resource name is the App ID URI of the App Registration or the SP name.

Make sure you have granted admin consent and double check that the Sharepoint URL is correct.

Per the first paragraph in the link your provided :

First things first

Make sure your Office 365 tenant is associated with your Azure AD tenant. When your tenants are associated you need to sign in to the Azure management portal and register your application principal in the Azure AD tenant. The next step is to enable the OAuth 2 implicit grant for your application principal. Make sure the application principal has at least Read user files and Read items in all site collections permissions for the Office 365 SharePoint Online application.

The below Git link's README explains how to properly create an AAD App Registration (Legacy) and grant consent AND enable implicit flow per the article :

https://github.com/Azure-Samples/active-directory-javascript-singlepageapp-dotnet-webapi

This link explains how to do implicit flow with the v2.0 endpoint :

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow

Although for the v2.0 endpoint you would be required to utilize MSAL.JS as your auth library.

Essentially what you will need to do is create an AAD Application Registration with the App ID URI with your Sharepoint URL, and then give it permissions per the article :

at least Read user files and Read items in all site collections permissions for the Office 365 SharePoint Online application

However, I'd like to point out that the article is quite old and alot of those links don't work properly. Most of the resources it's referring to are either outdated or unsupported.

Please refer to the official documentation on how to properly connect to SharePoint to properly implement a SharePoint solution.

https://docs.microsoft.com/en-us/sharepoint/dev/

https://docs.microsoft.com/en-us/sharepoint/dev/spfx/connect-to-sharepoint

https://docs.microsoft.com/en-us/sharepoint/dev/spfx/use-msgraph

https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/guidance/connect-to-api-secured-with-aad

https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/guidance/call-microsoft-graph-from-your-web-part

https://docs.microsoft.com/en-us/sharepoint/dev/spfx/connect-to-anonymous-apis