Receiving 'ErrorAccessDenied' response code , when an outlook web add-in issues a GetItem request via the makeEwsRequestAsync api

问题

We are testing an Outlook Web Add-in with different combinations of Exchange Server and Outlook client versions.

The add-in makes a GetItem request via the makeEwsRequestAsync API:

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
    xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
    xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" 
    xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
    <soap:Header>
        <RequestServerVersion Version="Exchange2013" 
            xmlns="http://schemas.microsoft.com/exchange/services/2006/types" soap:mustUnderstand="0" />
    </soap:Header>
    <soap:Body>
        <GetItem 
            xmlns="http://schemas.microsoft.com/exchange/services/2006/messages">
            <ItemShape>
                <t:BaseShape>IdOnly</t:BaseShape>
                <t:IncludeMimeContent>true</t:IncludeMimeContent>
            </ItemShape>
            <ItemIds>
                <t:ItemId Id="AAMkAGMwMDQxMDZhLTc5ODgtNDY5Yi1iYzk1LThlZDMyYjNiOTI3MgBGAAAAAACAJypvrerqS79u4AuHwVA6BwDco3spzUIpR7WutkjxuhkZAAAAAAEMAADco3spzUIpR7WutkjxuhkZAAA3RsNcAAA="/>
            </ItemIds>
        </GetItem>
    </soap:Body>
</soap:Envelope>

When we tested using Exchange Server 2016 with Outlook for Windows 2013, the GetItem operation fails with the following response:

<s:Envelope 
    xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
    <s:Header>
        <h:ServerVersionInfo MajorVersion="15" MinorVersion="1" MajorBuildNumber="225" MinorBuildNumber="41" Version="V2_48" 
            xmlns:h="http://schemas.microsoft.com/exchange/services/2006/types" 
            xmlns="http://schemas.microsoft.com/exchange/services/2006/types" 
            xmlns:xsd="http://www.w3.org/2001/XMLSchema" 
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>
    </s:Header>
    <s:Body 
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
        xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <m:GetItemResponse 
            xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
            xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
            <m:ResponseMessages>
                <m:GetItemResponseMessage ResponseClass="Error">
                    <m:MessageText>Access is denied. Check credentials and try again.</m:MessageText>
                    <m:ResponseCode>ErrorAccessDenied</m:ResponseCode>
                    <m:DescriptiveLinkKey>0</m:DescriptiveLinkKey>
                    <m:Items/>
                </m:GetItemResponseMessage>
            </m:ResponseMessages>
        </m:GetItemResponse>
    </s:Body>
</s:Envelope> 

For the same account if we try from Outlook 2016 for Windows or from the Outlook Web App, the add-in works fine.

How could I debug this further? Is there any known limitation? Could you please help.

JS Code for framing request:

function addSoapEnvelope(body) {

var request =
    '<?xml version="1.0" encoding="utf-8"?>' +
    '<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"' +
    '               xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"' +
    '               xmlns:xsd="http://www.w3.org/2001/XMLSchema"' +
    '               xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"' +
    '               xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">' +
    '  <soap:Header>' +
    '    <RequestServerVersion Version="Exchange2013" xmlns="http://schemas.microsoft.com/exchange/services/2006/types" soap:mustUnderstand="0" />' +
    '  </soap:Header>' +
    '  <soap:Body>' + body + '</soap:Body>' +
    ' </soap:Envelope>';

return request;

}

function getItemRequest(id) {
var body = 
    '<GetItem xmlns="http://schemas.microsoft.com/exchange/services/2006/messages">' +     
    '      <ItemShape>  <t:BaseShape>IdOnly</t:BaseShape>  <t:IncludeMimeContent>true</t:IncludeMimeContent>  </ItemShape>' +
    '      <ItemIds><t:ItemId Id="' + id + '"/></ItemIds>' +
    '</GetItem>';
return addSoapEnvelope(body);

}

var request = getItemRequest(itemid);

Office.context.mailbox.makeEwsRequestAsync(request, getMessageCallBack, requestContext);

EWS logs from exchange server

2017-08-17T13:07:30.548Z,32e3b547-77aa-451c-9981-fbccecec0769,15,0,847,30,,Bearer,True,user1_mailbox@qa.sample.com,qa.sample.com,Microsoft Office/15.0 (Windows NT 10.0; Microsoft Outlook 15.0.4805;

Office extension have no permissions to access any other mailboxes then the mailbox provided in the user context. at Microsoft.Exchange.Services.Core.Types.StoreSessionCacheBase.ConnectOnce(ExchangePrincipal mailboxToAccess CallContext callContext Boolean unifiedLogon) at Microsoft.Exchange.Services.Core.Types.StoreSessionCacheBase.CreateMailboxSessionBasedOnAccessType(ExchangePrincipal mailboxToAccess CallContext callContext Boolean unifiedLogon) at Microsoft.Exchange.Services.Core.Types.AppWideStoreSessionCache.GetCachedMailboxSessionByGuid(Guid mailboxGuid CallContext callContext Boolean unifiedLogon) at Microsoft.Exchange.Services.Core.Types.MethodWideStoreSessionCache.GetCachedStoreSessionByMailboxGuid(Guid mailboxGuid Boolean unifiedLogon) at Microsoft.Exchange.Services.Core.Types.MethodWideStoreSessionCache.GetCachedMailboxSession(MailboxId mailboxId Boolean unifiedLogon) at Microsoft.Exchange.Services.Core.Types.IdConverter.ConvertId(CallContext callContext IdHeaderInformation headerInformation ConvertOption convertOption BasicTypes expectedType List1 attachmentIds String changeKey Int32 hashCode Boolean unifiedLogon Item& cachedItem) at Microsoft.Exchange.Services.Core.Types.IdConverter.ConvertItemIdToIdAndSession(BaseItemId baseItemId ConvertOption convertOption BasicTypes expectedType Item& cachedItem) at Microsoft.Exchange.Services.Core.GetItem.<>c__DisplayClass1.<Execute>b__0() at Microsoft.Exchange.Common.IL.ILUtil.DoTryFilterCatch(TryDelegate tryDelegate FilterDelegate filterDelegate CatchDelegate catchDelegate) at Microsoft.Exchange.Services.Core.GetItem.Execute() at Microsoft.Exchange.Services.Core.ExceptionHandler1.Execute(CreateServiceResult createServiceResult Int32 index GenerateMessageXmlForServiceError generateErrorXml);

来源：https://stackoverflow.com/questions/45593520/receiving-erroraccessdenied-response-code-when-an-outlook-web-add-in-issues