Delegating/Forwarding SharePoint on-prem (ADFS) identity to call Exchange Online API

Question

I have a SharePoint (2010) on-premises, plugged to an ADFS server. I deploy custom components (Web parts, _layouts pages) with custom code onto it.

One of these components must access data stored in an Exchange Online (Office 365) for the current user, like last emails and calendar events.
I'm trying to get this done from the server-side code hosted in my SharePoint. SharePoint and Office 365 are both connected to the same on-prem ADFS.

The following diagram shows the situation:

I cannot find any information on how to code the access delegation to the Exchange Online.

Is there any code sample, tutorial or at least some hints on how to get access to the Exchange data on-behalf of the current user in this situation?
i.e. delegating credentials from SharePoint on-prem (ADFS) to Exchange Online API (same ADFS)?

As the user has already logged on the on-prem SharePoint (via ADFS), I don't want her/him to logon again or to give consent for a third-party app (thus excluding Graph API?).

• How can I get the correct "token" from ADFS while running server-side code on the SharePoint side, and then use it to get a token from Office 365?
• What API can I use to get the correct Office 365 "token" to authenticate the Exchange API request?
• What Exchange API can I use? EWS ? REST?

Notes:

• after running some tests, I'm quite confident we can replace "SharePoint" by "any ASP.NET app" in my question.
• if there's at least a "simple" solution all client-side, I could settle for it.

Answer 1

You can use one of ADFS features called ActAs.
When user is authenticated with ADFS in some ASP.NET application, usually there is a "BootstrapToken":

((IClaimsIdentity)Thread.CurrentPrincipal.Identity).BootstrapToken; 

holding security bits about authenticated user. Using ActAs feature you can request new token for another relying party, which accepts ADFS authentication.
The tricky part is that "some ASP.NET application" is your SharePoint and "another relying party" is Exchange Online.

Theoretically, in your serer side code, you can do something like this:

var userToken = ((IClaimsIdentity)Thread.CurrentPrincipal.Identity).BootstrapToken;

var token = GetActAsToken(userToken);

var client = new HttpClient
{
    BaseAddress = _baseAddress
};

client.SetToken("SAML", token.TokenXml.OuterXml);
var response = client.GetAsync("exchange api").Result;
// or attach token to EWS somehow

private SecurityToken GetActAsToken(SecurityToken bootstrapToken)
{
    var factory = new WSTrustChannelFactory(
        new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
        new EndpointAddress(_stsAddress));
    factory.TrustVersion = TrustVersion.WSTrust13;
 //some "service account" required in order to issue "act as" tokens
    factory.Credentials.UserName.UserName = "middletier";
    factory.Credentials.UserName.Password = "abc!123";

    var rst = new RequestSecurityToken
    {
        AppliesTo = new EndpointAddress(_serviceAddress),

        RequestType = RequestTypes.Issue,
        KeyType = KeyTypes.Symmetric,
        ActAs = new SecurityTokenElement(bootstrapToken)
    };

    var channel = factory.CreateChannel();
    var delegationToken = channel.Issue(rst);

    return delegationToken;
}

Honestly, never tried this, just some points to think, google and try for you.

Some links:

pass-adfs-token-to-a-service
Requesting Delegation (ActAs) Tokens using WSTrustChannel
Delegating secure tokens from one relying party to another
Identity Delegation with AD FS 2.0 Step-by-Step Guide
ebservices-adfs-actas