My question is exactly this question, but specifically this part:
how to use OAuth in SP 2016 on-prem from JavaScript? Which authentification endpoint must be used? Which flows are supported? We are not talking about an add-in here, but about plain JS running in another host
which did not actually get answered. Per that question, "SharePoint only accepts OAuth for CORS requests", but the accepted answer is a workaround to get "normal" CORS (using cookies or Authorization header) instead. I'd like to see if/how I can set up an OAuth flow instead.
In short, I have a totally by-the-book unmodified SP2016 install that uses Windows Auth (NTLM) for interactive login. I need to make REST API calls from a normal single-page application hosted in another domain (again, not a "Sharepoint Add-In", not hosted in any Sharepoint). If I disable CORS protections, e.g. using Chrome with --disable-web-security, everything works already.
Do I need any extra services on the SP server? I found a SecurityTokenService (STS?) at /_vti_bin/sts/spsecuritytokenservice.svc which gives me instructions about how to get a token from (WFC, I guess?) desktop clients, but I suspect that's not intended to be used in my situation. I see mention of /_layouts/15/OAuthAuthorize.aspx but I can't find much in the way of documentation or examples.
OAuthAuthorize.aspxbut it complains that "The Azure Access Control Service is unavailable". I'm on-prem, not SP Online. Am I supposed to install some kind of separate Azure Access Control Service component locally? All the references I can find online are talking about actual Azure (accounts.accesscontrol.windows.net?) for authentication.