Client Object Model Authentication using SharePoint App permission

Question

I'm developing a SharePoint App that is provider-hosted.

Could I access to a site collection using App permission (this means using ProductID and IssuerID and etc) without StandardToken?

Usually the access model is like below:

1. An user access to SharePoint site.
2. The user perform any action (e.g. click custom button from app).
3. An access URL with StandardToken from SharePoint to Provider was created.
4. Provider parses the URL using SharePointContext.cs and accessed to SharePoint objects.

Now I would like to access SharePoint object from Provider without access to SharePoint site.

1. An user access to a page from Provider.
2. The user perform any action (e.g. click button in the page)
3. Provider accesses to SharePoint Object and do some job.

The common method for this usage is Client Object Model. The authentication for this method uses User Profile Service, in my mind. This requires to save user id and password, and I want to avoid this way.

Answer 1

I guess what you are looking for is App Only Access to SharePoint. In this mode you can access SharePoint with App permissions only (your App has to request these permissions and at the time of installation these should be accepted). Check for option "Allow the app to make app-only calls to SharePoint" in your App's AppManifest file.

Once you App has these permissions, it can use TokenHelper.GetAppOnlyAccessToken to get the access token and use it to create the client context. This can be done completely outside of SharePoint then as you want to. All operations to SharePoint will then be performed in context of the App (not any user). Please read more here:

https://msdn.microsoft.com/en-us/library/office/fp179892.aspx

For completeness sake, I want to add here that this can also be achieved in the context of user by use of refresh tokens but it has some expiry so App only access might work better for you.