Provider host app getting windows logon prompt

Question

I have converted my existing ASP.NET web application as a "Provider hosted app" as per the MSFT documentation and installed on my Sharepoint 2013 site. The moment I navigate from Sharepoint site to Provider host Web application, I am getting the windows login prompt for credentials. Why so?

I was under an impression like if we have a logged-in on sharepoint site and while we navigate to our "provider hosted app", the access details will get passed over. While checking solutions over internet, it is mentioned we need to add the provider-hosted-app url into intranet zone, but mine is public facing site. How to achieve "single sign on" from Sharepoint site to app ?

Answer 1

Here , we have one option in Provider Hosted app to avoid this windows logon prompt by configuring App Only authorization policy ,

which works only on the permission level the app is having irrespective to the current user permission.

It doesn't need any user context in the process for generating context token so it doesn't prompt for user credentials again.

But this you can use if you are not going to user user context anymore in the app part.

this can be configured in App Manifest file by checking the Allow the app to make app only calls to SharePoint option:

and using CreateAppOnlyClientContextforSPHost() method while generating the SharePoint ClientContext object

ClientContext context = SharePointContextProvider.Current.GetSharePointContext(Context).CreateAppOnlyClientContextForSPHost()

It'll avoid this multiple credential prompt in some scenarios where we don't need the user contexts.

The same approach we can use for sites with anonymous access as well.

please refer this article for more info : Add-in authorization policy types in SharePoint 2013

Answer 2

As you are using a public facing site, you should set up a ReverseProxy with Preauthentication in front of your SharePoint Farm like WebApplicationProxy.

WAP provides a lot of useful stuff:

• Security is increased, because only authenticated users can communicate with SharePoint
• You can pass one authentication to multiple backend-applications (SharePoint Portal, MySites, Provider Hosted Apps, ...). You can choose between Kerberos and Claims-Tokens. This feature has been improved on Windows Server 2016.
• Integration to Office client apps can be improved by using persistent cookies (no login required when opening a document)

Implementing ADFS+WAP is not the easiest task, but it's absolutely worth it.