I have a provider hosted app where the web site is running locally (not in azure) and the SharePoint app will be published to SharePoint online. (so user connects to SharePoint online site, clicks on app and is redirected to IIS server running locally).

Users don't have domain accounts and are external to my company, which means that the local IIS site will need to have anonymous access enabled(?) How do I ensure that the users accessing the IIS site have authenticated in SharePoint online?

(Most of the discussions around app security tend to focus on verifying the user has access to SharePoint resources. But I don't need users to access SharePoint. I need to ensure the user is valid before displaying data in the app).

3 Answers 3


See http://blogs.msdn.com/b/kaevans/archive/2015/03/23/using-openid-connect-with-sharepoint-apps.aspx where I explain that the app is anonymous by default but a user cannot access content because of the way that TokenHelper checks first for a valid context token. If a context token is passed, you use the context token to obtain an access token. If that call fails, then you do not show information to the user. That is the same result as what you asked for above, you can be assured that the user logged into SharePoint else you will not receive a valid access token.

If you use Visual Studio to create a new SharePoint provider hosted app and are using the app+user policy, then you can make a CSOM call to get their effective permissions to determine how to proceed. Alternatively, the blog post that I linked shows how you can call the Azure AD Graph API, which could be used to get the user's groups. Since you are using O365, you will have Azure AD at your disposal. You can use this to make further decisions on role-based access.

Slight corrections to Falak's points, provider hosted apps can be run on any platform. We have demonstrated low trust apps using Linux and using a variety of technologies such as PHP, Node.js, and Java. There is no requirement for Azure, the term "provider hosted" simply means that there is no hosting environment provided for you, you need to find a hosting environment such as AWS, Azure, Rackspace, your own data center, etc.

  • Thanks Kirk! Since I posted this, I've learned a bit more. For example, the TokenHelper class you mentioned is indeed in the default page using the VS templates for SharePoint app, but that code is not in any additional pages you add. So developers who add pages without knowing about this detail are adding pages that are available to anonymous users, as the templates are not "secure by default", which is usually a normal goal. Perhaps this will change with the templates that ship with VS 2015?
    – Mike2500
    May 13, 2015 at 1:45
  • Also, if your app has an image or a pdf, it will be available to anonymous users as the tokenhelper class is not running for these items. Perhaps images and PDFs could be secured with a custom HTTP hander? I'm not sure, and haven't seen that issue documented, which, again, is really strange, as things should be secure by default.
    – Mike2500
    May 13, 2015 at 1:47

At the time of developing Apps in local development environment, code runs on local machine and IISExpress is used to host web project http://localhost:1234. The challenge here is firewalls block events when debugging with O365 site therefore Visual Studio utilizes Windows Azure Service Bus, to open channel between O365 and local IISExpress to enable debugging. The whole process of moving control between O365 and local IISExpress site is managed by Visual Studio itself, during development time. However at deployment time for provider-hosted app, you must host web application at Microsoft Azure or own IT infrastructure, and publishing App on O365.

Most of the discussions around app security tend to focus on verifying the user has access to SharePoint resources. But I don't need users to access SharePoint. I need to ensure the user is valid before displaying data in the app

Use app only policy: This is where you evaluate permissions based on the permission of the app instead of user.

Look at Kirk's blog post for more details: App Only Context with ACS

  • Since you linked to the instructions for deploying an asp.net web app, I assume you're saying that there is no configuration of any kind needed for IIS that is particular to it being a remote hosted SharePoint app? Also, I understand about the app only policy, but I'm not trying to display data from SP in the app, I'm trying to display data from a local on-prem database. Since the site will be published anonymously, I'm trying to figure out how to properly secure the site.
    – Mike2500
    Jun 23, 2014 at 11:04

With regard to securing non managed code assets ie script or html files for low trust azure hosted provider apps just turn on the azure app service authentication using active directory as a provider. Then enable cors settings as discussed here https://stackoverflow.com/questions/42303635/sharepoint-add-in-not-working-with-azure-app-service-authentication-csrf-issue.

I have tested the following sample https://github.com/SharePoint/PnP/tree/master/Samples/Core.SharePointProxyForSpaApps in this manner and it works from sharepoint and anonymous access is disabled in the azure app service. No need for any custom http module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.