1

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow?

Overview on use-case, what we trying to achieve:

Two servers, on two different domains; Available only from inside (intranet)

User login into SharePoint, clicks on button - calls CORS Ajax request to the api.mydomain.com.

The problem is, which authentication for Web API should we use? User should not have to fill two login prompts... There are few candidates:

  1. Kerberos - however as far as I know, it will require end users to configure our servers as 'trusted sites', in Firefox, IE/Chrome and also some regedit modifications in Chrome... Maybe there is a way to avoid such complicated configuration for end-users?
  2. OAuth2 - although I have no idea how to use it with ActiveDirectory
  3. Use Claims-based auth from SharePoint - we could put inside the AJAX token from STS, therefore token will be available from JS - isn't it a security issue?
  4. Custom Auth (would like to avoid this at all costs)
  5. Your idea?

We cannot use ADFS because SharePoint 2013 is having issues with it.

What do you think about it? Which option will be the best for us and end-users?

  • This is authenticating server-to-server, right? Or are you talking about authenticating users from SharePoint to this other application? – user79537 Aug 20 '15 at 0:31
  • Authenticating users from SharePoint to the other app - for example, domain\testuser login into SharePoint, and after sending javascript ajax to 'the other app', he will be authenticated there as 'domain\testuser'. – ppatalong Aug 20 '15 at 10:13
1

I've used my custom OAuth2 authorization provider.

Flow:

  1. User access SharePoint
  2. SharePoint calls webApi /token OAuth2 impersonating current user
  3. WebApi returns token
  4. Token is returned to the user, now he can use it for api calls
  5. Only SharePoint calls to /token are allowed (SSL only)

Works pretty well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.