title: Trying to access hosted SharePoint 2013 from Java app gives me 401 although I use correct OAuth token
body: <p>I'm trying to access our company SharePoint 2013 instance, which is hosted at ourinstance.sharepoint.com, with small Java web application.</p>
  
  <p>I registered application through _layouts/15/AppRegNew.aspx this way:</p>
  
  <ol>
  <li>I let SP generate Client ID, Client Secret, </li>
  <li>to App Domain I set: ourdomain:8443</li>
  <li>to Redirect URL I set: <code>https://ourdomain:8443/our-redirect-processing</code></li>
  </ol>
  
  <p>I edited application permissions with _layouts/15/appinv.aspx, where I looked it up by client ID and edited its Permission Request XML to contain:</p>
  
  <pre><code>&lt;AppPermissionRequests AllowAppOnlyPolicy="true"&gt;
  &lt;AppPermissionRequest Scope="http://insideidc.sharepoint.com/oursite/web" Right="FullControl"/&gt;
  &lt;/AppPermissionRequests&gt;
  </code></pre>
  
  <p>Handler behind <code>https://ourdomain:8443/our-redirect-processing</code> is doing this:</p>
  
  <pre><code>JsonWebSignature jws = JsonWebSignature.parse(new JacksonFactory(), request.getParameter("SPAppToken"));
  JsonParser jsonParser = new JacksonFactory().createJsonParser(jws.getPayload().get("appctx").toString());
  AppCtx appCtx = jsonParser.parse(AppCtx.class, new CustomizeJsonParser());
  String appctxsender=jws.getPayload().get("appctxsender").toString();
  String[] splitApptxSender = appctxsender.split("@");
  String sharepointServerHostName = new URL(request.getParameter("SPSiteUrl")).getHost();
  String resource = splitApptxSender[0] + "/" + sharepointServerHostName + "@" + splitApptxSender[1];
  AuthorizationCodeTokenRequest tokenRequest = new AuthorizationCodeTokenRequest(new NetHttpTransport(), new JacksonFactory(),
      new GenericUrl(appCtx.getSecurityTokenServiceUri()), jws.getPayload().get("refreshtoken").toString());
  tokenRequest.setRedirectUri(request.getRequestURL().toString());
  String aud = (String) jws.getPayload().getAudience();
  tokenRequest.setClientAuthentication(new ClientParametersAuthentication(aud, secrets.get(aud)));
  tokenRequest.setGrantType("refresh_token");
  tokenRequest.set("resource", resource);
  tokenRequest.set("refresh_token", jws.getPayload().get("refreshtoken").toString());
  TokenResponse response = tokenRequest.execute();
  token = response.getAccessToken();
  </code></pre>
  
  <p>It uses com.google.api.client. auth, http and json classes.</p>
  
  <p>The token I get I use in REST call to this URL:</p>
  
  <pre><code>https://ourinstance.sharepoint.com/oursite/_api/web/getFolderByServerRelativeUrl('/thefolderIwant')/Files
  </code></pre>
  
  <p>with these Headers:</p>
  
  <pre><code>Accept: application/json;odata=verbose
  Authorization: Bearer theToken
  </code></pre>
  
  <p>The response asks me for logging in, while response header has WWW-Authenticate: NTLM set.</p>
  
  <p>First question: should such complex process of obtaining OAuth token end up with another credentials request?</p>
  
  <p>Second and main question: how can I construct domain\username for NTLM Authenticator, which I can build, when SharePoint is hosted for us?</p>