Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow?
Overview on use-case, what we trying to achieve:
Two servers, on two different domains; Available only from inside (intranet)
- SharePoint 2013, on https://shp.mydomain.com; (Claims-based authentication)
- ASP.NET Web Api, on https://api.mydomain.com (? authentication); Enabled CORS for sharepoint origin.
User login into SharePoint, clicks on button - calls CORS Ajax request to the api.mydomain.com.
The problem is, which authentication for Web API should we use? User should not have to fill two login prompts... There are few candidates:
- Kerberos - however as far as I know, it will require end users to configure our servers as 'trusted sites', in Firefox, IE/Chrome and also some regedit modifications in Chrome... Maybe there is a way to avoid such complicated configuration for end-users?
- OAuth2 - although I have no idea how to use it with ActiveDirectory
- Use Claims-based auth from SharePoint - we could put inside the AJAX token from STS, therefore token will be available from JS - isn't it a security issue?
- Custom Auth (would like to avoid this at all costs)
- Your idea?
We cannot use ADFS because SharePoint 2013 is having issues with it.
What do you think about it? Which option will be the best for us and end-users?