Where can I get a context token for SharePoint?
Contoso.com then extracts a refresh token from the context token and uses it to get an access token directly from ACS. It includes the access token in all its requests to SharePoint.
How does the OAuth token work in SharePoint?
It does this by passing the OAuth access token in the HTTP Authorization header. (Sample code for creating the header is provided in the Office Developer Tools for Visual Studio if your remote component is hosted on a .NET platform.) SharePoint validates the access token so that it is assured the token was issued by ACS.
Where does SharePoint store the authentication / session cookie?
By default, SharePoint stores the authentication/session (FEDAUTH) cookie as a persistent cookie on disk. This allows the user to close and reopen their browser and access SharePoint without having to re-authenticate.
How are fedauth and RTFA cookies used in SharePoint?
The FedAuth cookies enable federated authorization, and the rtFA cookie enables signing out the user from all SharePoint sites, even if the sign-out process starts from a non-SharePoint site. So, it is enough to provide SPOIDCRL HTTP header in order to perform authentication in SharePoint Online/Office 365, for example:
How are access tokens used in SharePoint add-ins?
SharePoint Add-ins that use the high-trust authorization system to gain access to SharePoint have to pass an access token (in JSON Web Token format) to SharePoint with each create, read, update, or delete (CRUD) request. SharePoint validates the token and serves the request.
Where is the OAuth access token stored in SharePoint?
It also assumes that you have a valid OAuth access token that is stored in the accessToken variable. You do not need the access token if you make this call from inside an app web, as you would in a SharePoint-hosted app. the specific question is how can I get the access token??
How are access tokens used in identity providers?
(For information about this value when the identity provider is SAML-based, see Steve Peschka’s blog posts Security in SharePoint Add-ins – Part 8 and Using SharePoint Add-ins with SAML and FBA Sites in SharePoint 2013. There is no actor claim, but there is an actortoken claim that contains a base 64-encoded inner token with a 12-hour lifespan.