Secure REST API that only works for users authenticated by App with SSO (OAuth?)

Question

I somehow need to accomplish the following:

1. User accesses a application written in JavaScript.
2. Application uses SSO to identify the user who is logged into Windows.
3. Application obtains the access role for that user for the application.
4. When the application performs a REST request, only authorized users with a specific role are allow retrieve data.

My company users Windows Active Directory (not Azure) with Kerberos protocol to manage our users login to their computers.

I'm having a hard time wrapping my head around implementing this in this environment. I can't find any resources or articles that talk about this kind of setup.

I feel OAuth is the right direction but don't know what needs to be build/configured.

• Do I need a new server running OAuth?
• Does that server need to connect to the Windows Active Directory?
• How does the JavaScript application get the secure token used for the REST API?

Is this even possible with this tech stack?

Answer 1

You need to setup something called Federation Services.

AD FS in Windows Server 2016 [AD FS 2016] enables you to add industry standard OpenID Connect and OAuth 2.0 based authentication and authorization to applications you are developing, and have those applications authenticate users directly against AD FS.

Reference to first image https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/overview/ad-fs-scenarios-for-developers

Here is the tutorial for second image https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/development/single-page-application-with-ad-fs

If you are cloud friendly, it's pretty straight forward with Azure AD and there are plenty of guides available https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/what-is-single-sign-on