I have a SharePoint Framework on-premises solution where I want to call securely an external web api, also on-premises (the same). This means that the logged on user identity should be passed to the external web api in the request. The external web api should be able to verify if the user's identity is genuine.
What authentication would I need to use on my web api?

I was thinking about a solution similar to a provider hosted app. But I do not know how to get and pass a token similar to the "AppContextToken", which then could be used to construct the SharePointContext.

  • How is your on-prem API secured? What authentication provider are you using? Feb 1 '18 at 20:37
  • I am designing/implementing a new API, so no decision made on authentication provider yet. In fact this is my question: which authentication provider should I use and how?
    – Matthias
    Feb 2 '18 at 23:02
  • If you're using windows authentication, it will probably 'just work' (although if you want to get a user access token you'd need to have a a high-trust s2s app). Other than that, SPFx is introducing webApiPermissionRequests for external APIs but that only appears to support Azure AD APIs. May 1 '18 at 9:29
  • What authentication provider do you use in SharePoint? May 3 '18 at 17:16
  • @Matthias I think you already have completed this by now. Could you let me know the solution which you have followed. Did you develop the Web api as a provider hosted add in? Thank you.
    – SPKan
    Jan 13 '20 at 23:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.