Pnpframework: no longer able to use OfficeDevPnP.Core.AuthenticationManager OR PnP.Framework.AuthenticationManager().GetACSAppOnlyContext

[mvcsharepointdev]

I usually run those command inside my CSOM code to authenticate to Office 365 using ClientId + ClientSecret:-

using (ClientContext context2 = new PnP.Framework.AuthenticationManager().GetACSAppOnlyContext(siteUrl, clientId, clientSecret, AzureEnvironment.Production))
&

using (ClientContext context3 = new OfficeDevPnP.Core.AuthenticationManager().GetAppOnlyAuthenticatedContext(siteUrl, clientId, clientSecret, AzureEnvironment.Production))

But starting from yesterday the above commands are raising these errors:-

Unhandled Exception: Microsoft.IdentityModel.SecurityTokenService.RequestFailedException: Token request failed. ---> System.Net.WebException: The remote server

any advice? i checked the expiry date for the app and it is still valid till july 2021.. also i opened a ticket with Microsoft and they mentioned that they do not support these commands..

[jansenbe]

@mvcsharepointdev : could this be related with the TLS 1.2 enforcement that's being rolled out. Check https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/provider-hosted-app-pha-application-errors-tls-errors-and-401/ba-p/2273611 for more details.

Are there inner exceptions that provide more details?

[nathan-swannet]

Since a few days, more and more of our customers are reporting this issue.

Sometimes the code which uses the Pnp.Framework and a client id and secret works and other times it doesn't.
We make use of the function GetACSAppOnlyContext in the AuthenticationManager.

When it fails, we get the same error stating the Token request failed..
In Fiddler we see that the tunnel to customer.sharepoint.com:443 fails on the TLS Handshake.

The windows server, which hosts the IIS site invoking the SharePoint calls is a Windows Server 2012 machine.
We already took these steps to no avail:

• SchUseStrongCrypto and SystemDefaultTlsVersions set to 1 in both registry locations (as stated in the TLS Best Practices)
• Double checked the .NET Framework version of the code (which is .NET 4.8)

We also created a small test console app in .NET 4.8 to isolate the issue and we can reproduce it there. It still seems to occur at random times. We suspect this is the load balancer of SharePoint which sometimes results in a server where the TLS updates are not yet pushed to.

EDIT:

After more testing we discovered that none of these cyphers were supported on the Windows Server 2012 machine:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

Only the above cyphers are supported by microsoft (as stated in this article).
By using the IISCrypto tool we were able to select these extra cyphers which solved our issue:

• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

[mvcsharepointdev]

2012 machine:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

Only the above cyphers are supported by microsoft (as stated in this article).
@nathan-swannet
yes we also host those console applications inside windows server 2012 R2.. and today i found that the code worked for couple of times and failed on other.. so my question is how i need to modify my code to allow it to work well?

[mvcsharepointdev]

@mvcsharepointdev : could this be related with the TLS 1.2 enforcement that's being rolled out. Check https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/provider-hosted-app-pha-application-errors-tls-errors-and-401/ba-p/2273611 for more details.

Are there inner exceptions that provide more details?

@jansenbe ok thanks for the info... so how i can modify my code to work with this change?
Thanks

[nathan-swannet]

2012 machine:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

Only the above cyphers are supported by microsoft (as stated in this article).
@nathan-swannet
yes we also host those console applications inside windows server 2012 R2.. and today i found that the code worked for couple of times and failed on other.. so my question is how i need to modify my code to allow it to work well?

You don't need to change your code. You have to make sure the necessary configuration changes have been made to the server running your code to ensure it supports TLS 1.2 and one of the supported cyphers.

Read my post above carefully. Normally it should do the trick.

[mvcsharepointdev]

2012 machine:

• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

Only the above cyphers are supported by microsoft (as stated in this article).
@nathan-swannet
yes we also host those console applications inside windows server 2012 R2.. and today i found that the code worked for couple of times and failed on other.. so my question is how i need to modify my code to allow it to work well?

You don't need to change your code. You have to make sure the necessary configuration changes have been made to the server running your code to ensure it supports TLS 1.2 and one of the supported cyphers.

Read my post above carefully. Normally it should do the trick.

@nathan-swannet ok thanks but will selecting these extra cyphers has any drawbacks on the server? as the server which host the SharePoint console application also host some iis sites

[nathan-swannet]

No, it won't. You just tell the server that it's permitted to use those extra cypher suites.
You can read more about it here.

[mvcsharepointdev]

No, it won't. You just tell the server that it's permitted to use those extra cypher suites.
You can read more about it here.
@nathan-swannet many thanks
ok i downloaded the tool from @ https://www.nartac.com/Products/IISCrypto/ and i select these 2 optios:-

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

i restarted the windows 2012 R2 server and i can see that the console applications are working well now..
one question i have do we need to change the order of the cyphers? second question can i remove the tool or if i do so i will loose the configuration i did?

[nathan-swannet]

You don't need to change the order. It already prioritises the strongest supported cypher suite.
The tool can be removed safely. The configuration is applied to the server itself with the help of the tool. If no group policy is active which can override the supported cyphers, you're good to go.

[jansenbe]

@mvcsharepointdev : did you manage to get the TLS changes working now at your side?

[jansenbe]

Closing per no feedback anymore