Office 365 SharePoint v1.0 Authorization Error

Question

I have a client application that uses the Office 365 SharePoint Preview API. Recently (as of October 2014) Microsoft has published version 1.0 of this API . The authentication steps used with the preview API no longer work with version 1.0.

To demonstrate the problem, I created a short node.js script . The script does the following:

• Allows launching the browser. Gives the redirect URL to localhost and starts the server to catch the redirect post authorization.
• POST to https://login.windows.net/common/oauth2/token to get the access token
• GET to Office 365 Discovery to get the SharePoint API endpoint
• POST to https://login.windows.net/common/oauth2/token with update token to get a new access token
• GET to the SharePoint API endpoint to get a list of files

The script can be used with the preview API and version 1.0 of the API. It can get a list of JSON files from the preview API, but does not work with the following version 1.0 (on the last call):

 { "error": { "code": "-2147024891, System.UnauthorizedAccessException", "message": "Access denied. You do not have permission to perform this action or access this resource." } } 

Does anyone see something wrong in the call sequence?

Please see the sample script for more details.

Answer 1

Thank you for coming in contact, and we appreciate the feedback. Fixed a fix to address administrator access to files / folders through the file API. If you are still at a development / research stage, you can consider the following unlocking measures:

a. Temporarily add the user as administrator on the website of my site

b. Temporarily obtain AllSites permissions for the application

I will update this thread as soon as the problem is fixed in Production, which should happen very soon.

Answer 2

When looking at your scripts, it looks like you are using a hard coded resource identifier ("Microsoft.SharePoint") when I consider it to be new ("domain-my.sharepoint.com"). If you use multi-tenant, it will be dynamic and accessible from a discovery call and probably an identifier that you should use every time. If you have one tenant, then I guess you can write it down hard.