I have converted my existing ASP.NET web application as a "Provider hosted app" as per the MSFT documentation and installed on my Sharepoint 2013 site. The moment I navigate from Sharepoint site to Provider host Web application, I am getting the windows login prompt for credentials. Why so?

I was under an impression like if we have a logged-in on sharepoint site and while we navigate to our "provider hosted app", the access details will get passed over. While checking solutions over internet, it is mentioned we need to add the provider-hosted-app url into intranet zone, but mine is public facing site. How to achieve "single sign on" from Sharepoint site to app ?

2 Answers 2


Here , we have one option in Provider Hosted app to avoid this windows logon prompt by configuring App Only authorization policy ,

which works only on the permission level the app is having irrespective to the current user permission.

It doesn't need any user context in the process for generating context token so it doesn't prompt for user credentials again.

But this you can use if you are not going to user user context anymore in the app part.

this can be configured in App Manifest file by checking the Allow the app to make app only calls to SharePoint option:

enter image description here

and using CreateAppOnlyClientContextforSPHost() method while generating the SharePoint ClientContext object

ClientContext context = SharePointContextProvider.Current.GetSharePointContext(Context).CreateAppOnlyClientContextForSPHost()

It'll avoid this multiple credential prompt in some scenarios where we don't need the user contexts.

The same approach we can use for sites with anonymous access as well.

please refer this article for more info : Add-in authorization policy types in SharePoint 2013

  • Thanks esaki for update. But I already I have Web Level & Site Level full control on app manifest. What I could understand is like , on my provider host app on IIS, I have "Disabled" anonymous authentication and my requirement is who ever logged on Sharepoint site need to able to seems enter my provider hosted app and on my app, I need to get the UserAccount details using his Id. Say, <DomainName>\<SamAccountName>. Will that be possible? Dec 20, 2016 at 1:53
  • yes , if the user id are available then the user details can be obtained in code level by resolving the user
    – Esaki
    Dec 20, 2016 at 6:09
  • Thanks for replying. I agree to your point. But Why Windows prompt is happening? Dec 21, 2016 at 19:32
  • here , the Provider Hosted app is hosted as a web site in separate IIS server , here it needs separate Authentication for that , so while trying to access any content from the Provider Hosted app content it prompts for credentials again , when you're using App only policy it doesn't need any authentication as the app has been provided with required access at the time of installing
    – Esaki
    Dec 22, 2016 at 6:22

As you are using a public facing site, you should set up a ReverseProxy with Preauthentication in front of your SharePoint Farm like WebApplicationProxy.

WAP provides a lot of useful stuff:

  • Security is increased, because only authenticated users can communicate with SharePoint
  • You can pass one authentication to multiple backend-applications (SharePoint Portal, MySites, Provider Hosted Apps, ...). You can choose between Kerberos and Claims-Tokens. This feature has been improved on Windows Server 2016.
  • Integration to Office client apps can be improved by using persistent cookies (no login required when opening a document)

Implementing ADFS+WAP is not the easiest task, but it's absolutely worth it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.