We are new to SharePoint application development (for 2013) and I had some questions I wanted some clarification around:
Question 1: Our app is a provider hosted app which has it's own authentication/authorization model which is compatible with WS-federation. Is it possible to leverage the claims based authentication model existing in SharePoint to authenticate a SharePoint user to our cloud hosted app? My understanding is yes. Unfortunately, I am having difficulty understanding the following:
- what do I need to do in the app (the .app file) if anything to facilitate this?
- where do I put the certificate so that when a claim is made our identity federation server is able to validate the claims? We do have a ping federate server configured on site we can leverage. I wanted to check if there are other out of the box options
Question 2: Alternative approach of course is to leverage Oauth to have the SharePoint user authorize against our IDP and leverage that for API calls. Our backend requires each user to have their own accesstoken. Where do I persist this access token? Can I have the app persist it in the SharePoint user profile in a way such that only the farm admin has access to it? I can store the access token in the app web but I need to get an answer for question 1 to determine how to secure access to the access token.
Question 3: Is there a different approach that can be taken?
My hope is that we can leverage WS-Federation (passive requestor) to generate SAML and have the users go against our Ping federate servers to establish sessions to be able to interact with our cloud hosted app exposed through the SharePoint 2013 app model.
Any insights will be greatly appreciated. Thanks in advance.
