How to connect to SharePoint from different server

Question

I am using SharePoint 2013 with AD authentication. Since the front end application is made in Java I am using .net Web APIs to connect to the SharePoint server. So any request from the user browser(Intranet) will call the Java Code that will call the URL exposed from the .net web APIs to connect to the SharePoint server. The front end application will also be AD authenticated.

The front end application will be deployed on different tomcat server (Say server 1) and the SharePoint will be on a different IIS server (Say Server 2) and I can also deploy the .net Web APIs on Server 2 in the same IIS as SharePoint if it is required.

So the issue is coming when I am calling the .net APIs from an application that is hosted outside of Server 2. I have made an dummy .net Web application and hosted it on the server 2 and then everything was working. So if the SharePoint, Front End Application and the APIs are on the same server the structure is working as expected but the moment I take the front end application out of the server 2 (which is the requirement), the SharePoint server responds with Unauthorised error(401).

ClientContext clientContext = new ClientContext(siteUrl);
clientContext.Credentials = CredentialCache.DefaultNetworkCredentials;

As per my understanding so far the code above is able to Authenticate the current user when the Front End Appliation is inside the same server otherwise not.

So how can I pass the authentication from Front End Application that will pass some cookie or token to web api that I can use pass further in clientContext. And also I can not UserName and Password to authenticate the clientContext in any condition

Thanks in advance.

Answer 1

You will have to use a federated SAML authentication service like Active Directory Federated Service. SharePoint is only going to recognize the AD forest that is part of your domain used for your SP farm. If you are going to use an outside server, you have to have some sort of claims authentication to pass an authenticaiton token to a hosted provider (your SP farm). ADFS will also have to run with its own certificate for which SharePoint can store it as a trusted token provider. You could make something custom, but along with having to build a custom SP claims provider (Secure Token Service), you would also have to write a custom User Profile Sync to have SharePoint registar your users or they will not show in the People Picker. Based on your diagram, you would need another box in it with an ADFS server to do your SAML claims routing for your external AD.

Look at the diagram below to get an idea of what I am talking about. You have to have trusted claims to use an external AD forest with SharePoint.