I'm posting this question as a sanity check after a week of research and probably a lot of wrong turns.
SCENARIO: My project consists of an MVC app that communicates with a WCF services layer which that performs various document management tasks. The specific document storage platform is intended to be plugable, such that the WCF services can support any web storage service that exposes an API.
The MVC application is ultimately rendered to users within an IFrame, so 3rd party applications can leverage our app for their document management requirements.
NOTE: It can be assumed that users of the application are already authenticated with the application via an enterprise IdAM claims identity broker.
I have several questions which I'll try to summarize as best I can:
- Is a "SharePoint add-in" necessary to allow our WCF services to issue requests to the SharePoint API? (everything I've read indicates 'YES'). If so, would this be considered a "provider-hosted" add-in? Furthermore, would this scenario require "high-level trust" between the server hosting WCF services and the SharePoint server?
- How would request authorization between WCF and SharePoint work if users of the MVC app are already authenticated (enterprise claims provider) and no Azure Access Control component exists in our architecture?
- Is it possible to configure SharePoint to trust that requests issued by the WCF services are authorized and issued on behalf of authenticated users?
UPDATE: The SharePoint installation is hosted internally, not by Office 365.