I have an iframe with my web application embedded to a SharePoint page. I need to somehow authenticate him/her in this web app using Microsoft Azure AD without forcing him/her to enter login and password to perform request to https://login.microsoftonline.com/extSTS.srf where login and password are required. First, it seems insecure to disclose the credentials to my app and second, user will need to re-enter credentials again being already signed in to SharePoint. Instead it would be better to get somehow his current identity token from SharePoint and pass it through login.microsoftonline.com to make sure it's valid user.
Is something like this possible?
