This question is about using provider-hosted add-ins on-premises that use the low-trust authorization model - without requiring internet access.
Provider-hosted low-trust add-ins need a connection to Azure ACS and the farm needs to be registered in the cloud.
To use the low-trust system, the SharePoint Add-in must first be registered with Azure ACS [...]
Thus the on-premises farm needs to have internet access and the add-in needs to talk to ACS.
But what about farms without internet access? Is it possible to have kind of an on-premises ACS, that participates in the token flow?
(And yes, I know about high-trust add-ins but these are not feasable for my scenario since I need tokens that are bound to a user's identity. The add-in needs to act on behalf of the logged in user (e.g. do security trimmed search requests). To my understanding this is not possible with high-trust add-ins since there is no token. Correct me if I'm wrong here.)