Solved: Office 365 blog API authentication
If you are a blogging in SharePoint Office 365 you may have noticed that Window Live Writer is not able to connect to blog sites.
Troubleshooting begins
A fiddler trace shows a message which seems to suggest to log in to the site with the 'login automatically' option. Tried this, including adding the site to trusted and local zone, to no avail.
Fiddler trace of Live Writer trying to authenticate to SharePoint Online
Hitting a dead end with Live Writer I turned to a fork of MetaWebLogSharp I created a while back. The project is open source and very easy to use. The fork adds Category support and with the latest version also SharePoint Online support!
Apparently passing the username/password in the authentication call is not allowed by SharePoint Online.
Exception when passing username/password to a SharePoint blog in Office 365
This error makes sense. SharePoint Online relies on claims authentication. Passing credentials over xmlrpc shouldn’t be allowed. After a few attempts we figured out that we need to pass blank username/password parameters and instead passed authenticated cookies on every xmlrpc request.
Authentication Browser
AuthenticationBrowser will displays cookies when the user logs in on the browser on the left.
The key class here is AuthenticationBrowser. This class is part of the Instruction Framework and it implements the ClaimClientContext class discussed in the MSDN article Remote Authentication in SharePoint Online Using Claims-Based Authentication. This video shows this class being used to log in to both a SharePoint 2010 and 2013 local/remote sites.
AuthenticationBrowser also prints the cookies on the form so you can copy them and use in scripts without having to authenticate every time
MetaWeblog API
Now that our client is authenticated all we have to do is use the metaWeblog API as with any other blog.
The sample below shows how to retrieve a list of available blogs for the user and list all posts.
List of posts retrieved from SharePoint Online.