This post is a contribution from Mustaq Patel, an engineer with the SharePoint Developer Support team
Requirement: You have low trust Provider Hosted add-in that does on the fly OAuth (request permissions at runtime). You try to use this Provider Hosted add-in on a GCC High or DoD tenant. You see that the add-in does not work and you see an error message which seems to indicate that the add-in is looking for Client Id/Client Secret in wrong tenant.
Issue: when the add-in does on the fly OAuth the TokenHelper class that the add-in uses to get the OAuth process going and retrieve Access Token by validating Client Id and Client Secret in the Azure Active Directory, goes to a wrong AAD (i.e. public AAD) and will come back without any record matching with that Client Id and so the add-in fails. It is due to below hard coded string in the TokenHelper.cs file which is not valid for on the fly OAuth on GCC High/DOD tenants.
To fix this modify this error line as below.
Also modify method GetAcsGlobalEndpointUrl as below.
These 2 changes will fix the Provider Hosted add-in by causing the OAuth requests to go to correct authentication url for GCCH AAD.
If you are using same Provider Hosted add-in for both GCCH and public cloud or want to maintain same code base for both types of cloud, than we have to do some extra work. The code logic would be to find out the top domain of the sharepoint site and if it is .us than go to login.microsoftonline.us and if it is .com go to accesscontrol.windows.net.
Below is the complete code change.
- Declare 2 static variables as below (highlighted).
- Modify GetAuthorizationUrl to set SPTargetUrl as below
- Add below method, to get the top domain of the sharepoint url.
- Modify GetAcsGlobalEndpointUrl as below, to find if SharePoint is in GCC High by checking top domain (.us)
- Deploy the Provider Hosted add-in with this code change and test the add-in.
Please note that from the Provider Hosted add-in, you have to call GetAuthorizationUrl method to construct the redirecturl for add-in consent.
For more details please refer below article
On the fly oauth - https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/authorization-code-oauth-flow-for-sharepoint-add-ins.
GCC high and DoD - https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-us-government/gcc-high-and-dod.