I have set up a SharePoint web application with custom Trusted identity provider:
I have built provider hosted add-in (app) and successfully deployed it to a site within aforementioned web application's site collection. Provider hosted add-in uses high trust to authenticate to SharePoint. Provider hosted add-in uses the same Trusted identity provider and successfully authenticates to SharePoint add-in web. Provider hosted add-in successfully creates list items on add-in web using credentials from Trusted identity provider.
When I try to authenticate to add-in web (http://add-inprefix-6e792680cc37b1.isolateddomain.com:36218/sites/sitename/Addin/_layouts/15/mcontent.aspx) in browser I get presented with a dialog to choose authentication method:
Now if I choose Windows Authentication, I am able to authenticate and view lists and libraries on add-in web. The problem is that I cannot achieve the same with Trusted identity provider (WingtipSTS in this case). When I choose WingtipSTS, I get redirected to Trusted identity provider login page which is good. But when I authenticate, I get redirected to Access denied page:
I can successfully authenticate with the same credentials on host web. User which is used for authentication is site collection administrator. I can also verify that it exists in User profile service application.
Is there any way to authenticate on add-in web using credentials from custom Trusted identity provider?