SharePoint keeps on asking credentials in pop up

Question

We have created one SharePoint List custom form having Rest API and when users having Contribute access are trying to submit the form, they are getting pop up asking for credentials again and again. Although the functionality is working fine with Full Access and site collection admin users.

page is also becoming unresponsive after some time. Please assist

Answer 1

If you have client-side JavaScript executing REST calls, it will always run in the context of the current user, which means you cannot do anything in a REST call that the current user does not have permission to do themselves.

If you are using an on-premises installation of SharePoint Server that is using integrated NTLM security (meaning your Active Directory users are usually automatically logged into SharePoint without entering their credentials), then when your code attempts a client-side REST call that attempts to perform an action that the current user is not authorized for, the browser will automatically prompt them for AD credentials for a user account that Does have access.

If you are using an Online environment or one without integrated security, then instead of re-prompting the users for credentials, your code will just receive a 401 Unauthorized.

If your SharePoint farm is using integrated security with your local domain, there is no way to directly stop the user from being prompted for credentials when you try to access a resource they do not have access to. Instead, you will need to use the REST API to see if the current user has permission to perform the action, and display a more friendly error if they do not.

The following is an example, borrowed from a previous stack exchange post on checking a user's permissions:

function checkPermissions() {
    var call = jQuery.ajax({
        url: _spPageContextInfo.webAbsoluteUrl +
            "/_api/Web/effectiveBasePermissions",
        type: "GET",
        dataType: "json",
        headers: {
            Accept: "application/json;odata=verbose"
        }
    });

    call.done(function (data, textStatus, jqXHR) {
        var manageListsPerms = new SP.BasePermissions();
        manageListsPerms.initPropertiesFromJson(data.d.EffectiveBasePermissions);

        var manageLists = manageListsPerms.has(SP.PermissionKind.manageLists);

        var message = jQuery("#message");
        message.text("Manage Lists: " + manageLists);
    });
}

Answer 2

The root cause of the problem is security context. When we authenticate in Internet Explorer, we are providing our credentials within the context of a single application which is nothing but “Internet Explorer”. Then once we click on a document or open a document from SharePoint, we have just created another security context. On top of this , if we try to open a Microsoft files like word, excel , this will again try to connect office online server and authenticate there with the another context. This continues as much as applications are involved in that particular SharePoint page or resource.

Microsoft says about this issue is – it is a known issue or by the design of SharePoint.

How to fix this issue?

Now, we knew that what root cause of this issue, so we need to fix this issue. In order to fix this issue we need to perform one of the following or with the combinations.

• Implement Kerberos authentication in your SharePoint server.

• Connect all SharePoint servers those are part of SharePoint farm under a single common domain and make sure all users available in the single active directory domain same as SharePoint server domain.

• Make sure that there is no network devices, like proxy servers or firewalls which unveils the authentication information from the network communications between your local laptop/desktop and the SharePoint servers. If you have enabled Anonymous authentication then we need to make sure that Require Use Remote Interfaces permission is Disabled . 

• Select your web application from Central admin -> Click on Authentication Providers -> Click on the Default zone. Then we will get the below page. Here if we see enable anonymous access is checked then ensure that Require Use Remote Interfaces permission is unchecked.

• Make sure that SharePoint Web Services IIS website authentication configuration is correct means need to ensure the SharePoint Web Services IIS website is having same authentication as your web application where you are facing problem. To verify this follow this navigation – Go to IIS server and select the “SharePoint Web Services” web application and compare the below authentication with your SharePoint authentication.

• If you have DNS Proxy enabled, it is recommended that disable the DNS proxy and test your web application.

For details troubleshooting please refer the below article :

Why multiple times SharePoint users are asked to enter the credentials?