I somehow need to accomplish the following:
- User accesses a application written in JavaScript.
- Application uses SSO to identify the user who is logged into Windows.
- Application obtains the access role for that user for the application.
- When the application performs a REST request, only authorized users with a specific role are allow retrieve data.
My company users Windows Active Directory (not Azure) with Kerberos protocol to manage our users login to their computers.
I'm having a hard time wrapping my head around implementing this in this environment. I can't find any resources or articles that talk about this kind of setup.
I feel OAuth is the right direction but don't know what needs to be build/configured.
- Do I need a new server running OAuth?
- Does that server need to connect to the Windows Active Directory?
- How does the JavaScript application get the secure token used for the REST API?
Is this even possible with this tech stack?