The current user does not have the UseRemoteAPIs permission

[Yutolivo]

I setup trust for search between two farms according to this link. After configuring successfully, we use KQL query to get search results from receiving farm in sending farm.

These days, a user reports he cannot get search result from receiving farm in sending farm, after checking the log in sending farm, I find this error 'Microsoft.SharePoint.Client.ServerException: Query execution is only allowed with IgnoreSafeQueryPropertiesTemplateUrl=true when the user has the UseRemoteAPIs permission.',  then I check the logs in receiving farm I find the message like 'The current user does not have the UseRemoteAPIs permission but is trying to execute a query with IgnoreSafeQueryPropertiesTemplateUrl=true.', seems that the user doesn't have the UseRemoteAPIs permission. 

I am not sure why receiving farm doesn't check out the UseRemoteAPIs permission for the user, because the use is assigned with read permission by visitor group, limited access permission by style resources readers group. And the site collection feature : Limited-access user permission lockdown mode has already been deactivated. Another end user with same permission can get search result from receiving farm in sending farm.

I am not sure if the permission failure is related to 'one way trust domain' issue:

1. User1 is in domain 2.
2. Domain 1 trust domain 2, and they are in one way trust domain relationship.
3. Current user has been added in a domain group named all-stuff in domain 1.
4. If the document has been shared by all-stuff ad group directly or shared by a SP group which contains all-stuff ad group, DoesUserHavePermissions  method will fail to check User1's pemrission. 

I try to re-produce this scenario, but I don't get error.  I try to set the following properties for support search even if the user doesn't have UseRemoteAPIs permission.

query.IgnoreSafeQueryPropertiesTemplateUrl = false;
query.SafeQueryPropertiesTemplateUrl = "spfile://webroot/queryparametertemplate.xml";

As I didn't reproduce the error, I am not if this change can resolve the issue, also when I inspect the verbose logs in receiving farm, I don't find out the properties and the values information in CSOM request XML, so don't think this way can resolve the issue. 

Can anyone give me some suggestions? 

[#2]

@Yutolivo 

Not specifically related to your issue with search, however the when your user executes a search query it may be trying to access API at the site collection level.  I'll share here as well just in case it helps.  Typically the adjustment you mentioned in your post is for enabling Anonymous users to use SharePoint search API (like for web parts or other JavaScripty search customisation).

I was brought here because I was looking for the reason why the SharePoint Modern List View experience was receiving a 401 access denied and then repeatedly prompting the user to login as it was trying to access /_api/Site?$select=StatusBarLink,StatusBarText.  This issue will occur when a user has been granted permission at a sub-site level but does not have permission at the site collection level (or only has Limited Access at the site collection level).  The limited access is typically there as part of the Style Resource Readers group.

You will see in the developer window a pending authorisation for

https://www.website.ca/sitecollection/subsite/_api/Site?$select=StatusBarLink,StatusBarText

Followed by access denied messages in your ULS logs similar to:

PermissionMask check failed for {Guid}. Asking for 0x2000010000, have 0x1008010000

Specifically it will also fail with UnauthorizedAccessException on GetWebMetainfo 

The way you can fix this is by ADDING the UseRemoteAPIs base permission to the Limited Access role definition at the site collection root web level.  Please note, this should not be done for Anonymous access or public (internet) sites as it may expose API to attackers for Denial of Service.  Internally it should be OK to do as it simply allows end users to make calls to the API (the contents of the results of the API are still security trimmed).

Powershell you can use to resolve this is:

$siteUrl = "https://www.website.ca/sitecollection/"

$site = get-spsite $siteUrl
$web = $site.RootWeb

$limitedAccess = $web.RoleDefinitions["Limited Access"]
$limitedAccess.BasePermissions = "$($limitedAccess.BasePermissions), UseRemoteAPIs"
$limitedAccess.Update()

You're welcome!

Kevin Cole - SharePoint Microsoft Certified Master