2

The provider of my provider-hosted add-in needs to ask for SharePoint (Online) permissions on the fly. OAuth can be used to achieve this, as documented here in MSDN.

The authorization is low-trust and the target system is SharePoint Online. My provider is a custom web application.

To quote MSDN:

In some scenarios, an add-in can request permission to access SharePoint resources on the fly; that is, an add-in can request permission to access SharePoint resources dynamically at runtime, instead of at add-in installation time.

Looking at the add-in authorization flow there is a step (6) where my provider needs to talk to Azure ACS:

The add-in uses the authorization code to request an access token from ACS

This is part of the authorization code grant type, where the client (my provider) talks to the authorization server (ACS):

+----------+
| Resource |
|   Owner  |
|          |
+----------+
     ^
     |
    (B)
+----|-----+          Client Identifier      +---------------+
|         -+----(A)-- & Redirection URI ---->|               |
|  User-   |                                 | Authorization |
|  Agent  -+----(B)-- User authenticates --->|     Server    |
|          |                                 |               |
|         -+----(C)-- Authorization Code ---<|               |
+-|----|---+                                 +---------------+
  |    |                                         ^      v
 (A)  (C)                                        |      |
  |    |                                         |      |
  ^    v                                         |      |
+---------+                                      |      |
|         |>---(D)-- Authorization Code ---------'      |
|  Client |          & Redirection URI                  |
|         |                                             |
|         |<---(E)----- Access Token -------------------'
+---------+       (w/ Optional Refresh Token)

(Source)

Here is the catch: my provider is not connected to the internet (only intranet) so it cannot connect to ACS. However, users can use the browser to access the provider web application as well as the internet, so integration can happen in the browser.

The implicit grant type of OAuth is specifically designed for this setting:

+----------+
| Resource |
|  Owner   |
|          |
+----------+
     ^
     |
    (B)
+----|-----+          Client Identifier     +---------------+
|         -+----(A)-- & Redirection URI --->|               |
|  User-   |                                | Authorization |
|  Agent  -|----(B)-- User authenticates -->|     Server    |
|          |                                |               |
|          |<---(C)--- Redirection URI ----<|               |
|          |          with Access Token     +---------------+
|          |            in Fragment
|          |                                +---------------+
|          |----(D)--- Redirection URI ---->|   Web-Hosted  |
|          |          without Fragment      |     Client    |
|          |                                |    Resource   |
|     (F)  |<---(E)------- Script ---------<|               |
|          |                                +---------------+
+-|--------+
  |    |
 (A)  (G) Access Token
  |    |
  ^    v
+---------+
|         |
|  Client |
|         |
+---------+

(Source)

The implicit grant type is used to obtain access tokens [...] and is optimized for public clients known to operate a particular redirection URI. These clients are typically implemented in a browser using a scripting language such as JavaScript.

This is exactly the case here. Note that the client (my provider) does not need to connect to the authorization server (ACS).

Here's the question: can I use the implicit grant type to get an access token for my add-in? Or is only the authorization code grant type supported as documented here in MSDN?

(Note: This is about the "classic" SharePoint API, not Microsoft Graph and the corresponding mechanisms.)

  • Since you are SharePoint Online, why don't you want to implement Azure AD app, which supports implicit grant without any issues? – Sergei Sergeev Jan 13 '17 at 21:59
  • Or event better - create SharePoint provider add-in AND register Azure AD app for implicit flow and access token acquisition. – Sergei Sergeev Jan 13 '17 at 22:01
  • @Sergei I don't want to use Microsoft Graph right now to maintain compatibility with SP on-prem as well as not having to use preview APIs. Can the tokens acquired by Azure AD implicit flow be used with the "classic" SP API? – Heinrich Ulbricht Jan 14 '17 at 20:32
  • 1
    Can the tokens acquired by Azure AD implicit flow be used with the "classic" SP API? - of course they can. You just need to construct valid implicit flow request, for resource part of the url you need to provide your tenant, i.e. http://myorg.sharepoint.com – Sergei Sergeev Jan 15 '17 at 7:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.