1

I'm planning to build a SharePoint Online environment using the SharePoint Framework, and there is quite a bit of complex business logic that will exist in an external .NET Web API. Due to a variety of reasons, I don't plan to make use of SharePoint lists as much as your average SharePoint site, and instead will have the API own most of the data.

In order for this to truly work, I need to secure the API to only allow authenticated SharePoint users to consume it. I believe I can use bearer token authentication, with the tenant being my office 365 client, but can anyone confirm that my SharePoint online users will always be a part of my Office 365 directory? Is it possible to add or invite users to my SharePoint portal without also having them added to my O365 AD?

Additionally, I have documentation regarding the contents of a bearer token, but can someone confirm/deny that the token will contain SharePoint user and group information as well? Will I be able to determine the SharePoint sites and permissions a user has access to from the token alone?

Finally, is there a way to retrieve the token from client side JavaScript alone? Using the SharePoint framework, I plan to build most of the UI in custom JavaScript code, with asynchronous API requests being used to populate the page with data. To do so, I will need to pass up the access token with the request.

Thanks,
-Tim

Improve this question

1 Answer 1

Reset to default
1

Answers:

  • Can anyone confirm that my SharePoint online users will always be a part of my Office 365 directory? As far as I can tell, this is true
  • Can anyone confirm that the token will contain SharePoint user and group information as well? This is false. The JWT you receive from the implicit authorization flow does not contain relevant SharePoint information
  • Is there a way to retrieve the token from client side JavaScript alone? Yes - the code sample here outlines how to do so using the implicit authorization flow. Note that the sample is slightly outdated, but the idea is accurate
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.