.NET Core下SharePoint Online CSOM认证问题求助

Hey there! Let’s work through that authentication snag you’re hitting with NetCore.CSOM for SharePoint Online. Since you’re new to SPO, working exclusively with a client’s username/password, and building a .NET Core service to handle folder structure retrieval plus file uploads/downloads, here’s how to tackle your auth issues:

NetCore.CSOM supports this natively—you just need to set up the client context correctly. Here’s a working code snippet to implement this:

using Microsoft.SharePoint.Client;
using System.Security;

// Convert the client's password to a secure string (never hardcode plaintext!)
var securePassword = new SecureString();
foreach (char c in "ClientPasswordHere")
{
    securePassword.AppendChar(c);
}

// Initialize your SharePoint site context
using (var context = new ClientContext("https://yourclienttenant.sharepoint.com/sites/targetsite"))
{
    context.Credentials = new SharePointOnlineCredentials("clientusername@clienttenant.onmicrosoft.com", securePassword);
    
    // Test the connection by loading the site title
    context.Load(context.Web, web => web.Title);
    context.ExecuteQuery();
    
    Console.WriteLine($"Successfully connected to: {context.Web.Title}");
}

Important Note: This method fails if the client’s account has Multi-Factor Authentication (MFA) enabled. If that’s the case, skip to the app-only approach below.

For a backend service, app-only auth is far more reliable—it doesn’t depend on a user’s MFA status or account changes. Here’s how to set it up:

• First, you’ll need the client to register an app in their SharePoint tenant (or provide you with the app ID and secret). Grant the app granular permissions (e.g., Sites.ReadWrite.All for full site access, or more restricted permissions if possible).
• Use this code to authenticate with the app credentials:

using Microsoft.SharePoint.Client;
using System.Net.Http.Headers;
using System.Threading.Tasks;
using Newtonsoft.Json;

public static async Task<ClientContext> GetAppOnlyContext(string siteUrl, string clientId, string clientSecret)
{
    var context = new ClientContext(siteUrl);
    var tenantId = siteUrl.Split('.')[0].Replace("https://", "");
    var tokenEndpoint = $"https://accounts.accesscontrol.windows.net/{tenantId}/tokens/OAuth/2";

    using (var client = new HttpClient())
    {
        var requestContent = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("grant_type", "client_credentials"),
            new KeyValuePair<string, string>("client_id", $"{clientId}@{tenantId}"),
            new KeyValuePair<string, string>("client_secret", clientSecret),
            new KeyValuePair<string, string>("resource", $"00000003-0000-0ff1-ce00-000000000000/{tenantId}.sharepoint.com@{tenantId}")
        });

        var response = await client.PostAsync(tokenEndpoint, requestContent);
        var responseContent = await response.Content.ReadAsStringAsync();
        var token = JsonConvert.DeserializeObject<dynamic>(responseContent).access_token;

        // Attach the token to the client context
        context.AuthenticationMode = ClientAuthenticationMode.Anonymous;
        context.FormDigestHandlingEnabled = false;
        context.ExecutingWebRequest += (sender, e) =>
        {
            e.WebRequestExecutor.RequestHeaders["Authorization"] = $"Bearer {token}";
        };
    }

    return context;
}

Pro Tip: Store the client secret securely (use environment variables or a secrets manager like Azure Key Vault) instead of hardcoding it.

• MFA Blocking Credential Auth: If the client’s account uses MFA, the username/password method will throw errors immediately. Switch to app-only auth or use device code flow (not ideal for unattended services).
• Permission Denied Errors: Even after successful auth, 403 errors mean your user/app lacks the right permissions. Double-check that the client has granted the account/app access to the target site or folders.
• Outdated NetCore.CSOM Version: Make sure you’re using the latest version of the package—older releases often have auth-related bugs that’ve been fixed.

Once auth is working, you can easily implement your core functionality. For example, here’s how to retrieve a folder’s structure:

var web = context.Web;
var targetFolder = web.GetFolderByServerRelativeUrl("/sites/targetsite/Shared Documents/ArchiveFolder");
context.Load(targetFolder.Folders);
context.Load(targetFolder.Files);
context.ExecuteQuery();

// List subfolders
foreach (var subFolder in targetFolder.Folders)
{
    Console.WriteLine($"Subfolder: {subFolder.Name}");
}

// List files
foreach (var file in targetFolder.Files)
{
    Console.WriteLine($"File: {file.Name}");
}

内容的提问来源于stack exchange，提问作者Stefan R.