Contents
Authorization and authentication of SharePoint Add-ins. When a user signs in to SharePoint, the user’s security token is validated. The token is issued by an identity provider. SharePoint supports several kinds of user authentication. For more information, see Authentication, authorization, and security in SharePoint.
The authorization process assumes that the user has already been authenticated, which refers to the process by which SharePoint identifies the current user. SharePoint does not implement its own system for authentication or identity management, but instead relies on external systems, whether Windows authentication or non-Windows authentication.
What does OAuth 2.0 do for SharePoint add in?
You may have already heard that OAuth 2.0 plays an important role in the authentication and authorization of SharePoint Add-ins. It does, but it is not necessarily a part of the authorization story for every SharePoint Add-in.
What does the authorization code OAuth flow mean?
The sequence describes how an add-in that isn’t launched from within SharePoint can access resources in SharePoint. The flow involves a series of interactions between your add-in, SharePoint, the authorization server (which is ACS), and the end user at runtime.
Internet Information Services (IIS) websites that are created by SharePoint for serving web applications always have the Anonymous Authentication and Forms Authentication methods enabled, even when the SharePoint setting for Anonymous and Forms Authentication are disabled.
Classic-mode authentication is deprecated and can be managed only by using Windows PowerShell. A lot of features in SharePoint require claims-mode. The MigrateUsers method from SharePoint 2010 is now deprecated, it’s no longer the correct way to migrate accounts.
How to implement SAML token-based authentication with SharePoint Server?
To implement SAML token-based authentication with SharePoint Server, use the following steps which require planning in advance: Export the token-signing certificate from the IP-STS. Copy the certificate to a server in the SharePoint Server farm. Define the claim that will be used as the unique identifier of the user.
https://www.youtube.com/watch?v=YMliU4vB_YM
The authorization process verifies that an authenticated subject (a user or an add-in or both) has permission to perform certain operations or to access specific resources (for example, a list or a SharePoint document folder). SharePoint uses three types of authorization policies:
Can a SharePoint add in be launched from any website?
This type of add-in doesn’t have to be launched from, or even installed on, SharePoint. For example, it could be a native device add-in, an add-in that is launched from any website, or an Office Add-in launched from an Office application that wants to access resources on SharePoint on the fly.