My question is exactly this question, but specifically this part:
which did not actually get answered. Per that question, "SharePoint only accepts OAuth for CORS requests", but the accepted answer is a workaround to get "normal" CORS (using cookies or Authorization header) instead. I'd like to see if/how I can set up an OAuth flow instead.
In short, I have a totally by-the-book unmodified SP2016 install that uses Windows Auth (NTLM) for interactive login. I need to make REST API calls from a normal single-page application hosted in another domain (again, not a "Sharepoint Add-In", not hosted in any Sharepoint). If I disable CORS protections, e.g. using Chrome with
--disable-web-security, everything works already.
Do I need any extra services on the SP server? I found a SecurityTokenService (STS?) at
/_vti_bin/sts/spsecuritytokenservice.svc which gives me instructions about how to get a token from (WFC, I guess?) desktop clients, but I suspect that's not intended to be used in my situation. I see mention of
/_layouts/15/OAuthAuthorize.aspx but I can't find much in the way of documentation or examples.