Positively identify the current user from my javascript in SharePoint

Question

When logging into SharePoint a cookie called "AADAuth" is set on ".office.com". The contents of this cookie is a JWT and it positively identifies the current user. If I could get this cookie from my javascript in SharePoint, I could send the JWT to my custom API and with Microsofts public certificate, I would be able to positively verify the identity of the user.

However, since this cookie is on ".office.com" which is obviously not my SharePoint domain, I cannot access that cookie.

So is there a way to get the JWT on SharePoint?

Otherwise, is there any other way I can find any content on the client side javascript to positively identify the current user?

I know I can initiate a new authentication process from my javascript in SharePoint, but that takes time and I'm looking for a solution that doesn't take much time for the end user, so hopefully I can use some of the information already in SharePoint.

Answer 1

I'm going to include a couple of different methods as it seems you may be looking for a specialized solution rather than a general one.

General Solution

I'm going to expand on DevBot's answer using _spPageContextInfo.userId, which is a number, not the person's user name.

<script type="text/javascript">
    var spContextUserId;
    $(document).ready(function() {
        spContextUserId = _spPageContextInfo.userId;
        console.log('user context id: ' + spContextUserId);     

        console.log('Executing sp.js...');
        SP.SOD.executeOrDelayUntilScriptLoaded(loadSPUserProfiles, 'sp.js');    

    });

    function loadSPUserProfiles() {
        // ..wait for sp.js to load
        console.log('sp.js loaded.  Loading sp.userprofiles.js...');
        SP.SOD.executeOrDelayUntilScriptLoaded(getUserProperties, 'SP.UserProfiles.js');        
    }

</script>
<script type="text/ecmascript">
    var userProfileProperties;

    function getUserProperties() {
        try {
            console.log('sp.userprofiles.js loaded...');    
            console.log('Getting user properties...');
            var clientContext = new SP.ClientContext.get_current();
            var peopleManager = new SP.UserProfiles.PeopleManager(clientContext);
            userProfileProperties = peopleManager.getMyProperties();
            clientContext.load(userProfileProperties);
            clientContext.executeQueryAsync(onRequestSuccess, onRequestFail);
        }
        catch (err) {
            console.log(err.message);
        }
    }

    function onRequestSuccess() {
        console.log('in request success routine');
        var accountName = "";

        try {
            //console.log(userProfileProperties);
            //accountName = userProfileProperties.get_accountName; // also works
            accountName = userProfileProperties.get_userProfileProperties()['AccountName'];
            console.log('accountName from svc: ' + accountName);

            // Now see if that account name matches the ID
            getUserInfo(accountName, function(userInfo){
               console.log('User Id: ' + userInfo.ID);
               if (spContextUserId == userInfo.ID) {
                   alert('Verified');
               } else {
                   alert('Not verified.');
               }
           },
           function(sender,args){
              console.log(args.get_message());
           });                

        catch(ex) {
           console.log(ex.message);
      }

     function getUserInfo(userName, Success, Error)
     {
         var context = new SP.ClientContext.get_current();
         var userInfoList = context.get_web().get_siteUserInfoList();
         var query = new SP.CamlQuery();
         var viewXml = "<View> \
                <Query> \
                   <Where> \
                       <Eq><FieldRef Name='UserName' /><Value Type='Text'>" + userName + "</Value></Eq> \
                   </Where>  \
                </Query> \
                <RowLimit>1</RowLimit> \
              </View>";
         query.set_viewXml(viewXml);
         var items = userInfoList.getItems(query);
         context.load(items,'Include(Deleted,Department,EMail,FirstName,ID,IsActive,IsSiteAdmin,JobTitle,LastName,MobilePhone,Name,Notes,Office,Picture,SipAddress,UserName,WebSite,WorkPhone)');
         context.executeQueryAsync(function() {
             if(items.get_count() > 0) {
                 var item = items.itemAt(0);
                 Success(item.get_fieldValues());
             }
             else {
                 Success(null);
             }   
         }, Error);
    }
</script>

This getUserInfo function was posted at https://sharepoint.stackexchange.com/questions/31457/get-user-via-javascript-client-object-model , but I've used a similar construct, myself.

This takes the numeric ID assigned to a user by the page context and compares this against the People Manager version after getting the current web context. To me, this is about as effective as you're going to get using just the JSOM to verify that a user matches their login context, if we assume they are already on a SharePoint page and have been authenticated via Windows, as they should have been.

Tokens

If you are still trying to pursue getting the JWT or using a token method, or just otherwise need access to this path for some reason, say to make an add-in work or because they're accessing SharePoint from outside it, you're going to want to review Microsoft's documentation on what the tokens look like and how to create one, because using Context Token flow requires using the CSOM, not JSOM. There, you have to get a context token to get an access token:

 SharePointContextToken contextToken =
    TokenHelper.ReadAndValidateContextToken(contextTokenString, 
    Request.Url.Authority);
 string sharePointUrl = WebConfigurationManager.AppSettings.Get("RedirectUri");
 Response.Redirect(TokenHelper.GetAppContextTokenRequestUrl(sharePointUrl, Server.UrlEncode(Request.Url.ToString())));

where you have set up the RedirectUri in the web.config:

<configuration>
    <appSettings>
        <add key="RedirectUri" value="https://contoso.com/RedirectAccept.aspx" />
    </appSettings>
<configuration>

Instead, you'd have to translate all of this into a JSOM method to match what you say you're trying to achieve, creating your own using "Authorization flow", and then you should be able to use it against your API.

In the Authorization Code flow, there is no context token, so you cache the refresh token itself, and the user gets a new refresh token each time he or she launches the add-in (https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/handle-security-tokens-in-provider-hosted-low-trust-sharepoint-add-ins#CacheKey). It must redirect the user to the SharePoint's OAuthAuthorize.aspx:

/oauthauthorize.aspx?IsDlg=1&client_id=c78d058c-7f82-44ca-a077-fba855e14d38&scope=list.read&response_type=code&redirect_uri=https%3A%2F%2Fcontoso%2Ecom%2Fredirectaccept.aspx

• IsDlg=1 would launch an authentication dialog.
• The client_id has to be the same as when your add-in got registered with SharePoint.

Perhaps this would work as a GET inside an AJAX call. Microsoft talks about redirecting the user to this URL, which indicates to me it would be a call to actually change the URL:

window.location.href = 'http://www.mysharepointsite.com/somesite/oauthorize.aspx?...';

My suggestion would be to review this documentation thoroughly and construct what they say you need/perform the redirects required using this information:

https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/handle-security-tokens-in-provider-hosted-low-trust-sharepoint-add-ins

https://learn.microsoft.com/en-us/sharepoint/dev/sp-add-ins/authorization-code-oauth-flow-for-sharepoint-add-ins

Without more information on how you are accessing SharePoint, and why you think the token method is the only way to verify an account, this is a difficult question to answer as it seems like you may have a specific scenario you are trying to build for, and there's often a lot of trial-and-error involved to ensure all permissions, GUIDs, etc. are registered and accurate.

Answer 2

You can grab _spPageContextInfo.userId or _spPageContextInfo.userLoginName.

More info about that object here.