My question is exactly this question, but specifically this part:

how to use OAuth in SP 2016 on-prem from JavaScript? Which authentification endpoint must be used? Which flows are supported? We are not talking about an add-in here, but about plain JS running in another host

which did not actually get answered. Per that question, "SharePoint only accepts OAuth for CORS requests", but the accepted answer is a workaround to get "normal" CORS (using cookies or Authorization header) instead. I'd like to see if/how I can set up an OAuth flow instead.

In short, I have a totally by-the-book unmodified SP2016 install that uses Windows Auth (NTLM) for interactive login. I need to make REST API calls from a normal single-page application hosted in another domain (again, not a "Sharepoint Add-In", not hosted in any Sharepoint). If I disable CORS protections, e.g. using Chrome with --disable-web-security, everything works already.

Do I need any extra services on the SP server? I found a SecurityTokenService (STS?) at /_vti_bin/sts/spsecuritytokenservice.svc which gives me instructions about how to get a token from (WFC, I guess?) desktop clients, but I suspect that's not intended to be used in my situation. I see mention of /_layouts/15/OAuthAuthorize.aspx but I can't find much in the way of documentation or examples.

  • I've been reading a lot about OAuth 2.0 lately, and it looks like the current best practice for my situation is to use the "authorization code" flow with the PKCE extension. Is this possible with the services I have in place already? – Coderer Aug 17 '20 at 14:19
  • Another update: I tried getting an authorization code from OAuthAuthorize.aspx but it complains that "The Azure Access Control Service is unavailable". I'm on-prem, not SP Online. Am I supposed to install some kind of separate Azure Access Control Service component locally? All the references I can find online are talking about actual Azure (accounts.accesscontrol.windows.net?) for authentication. – Coderer Aug 18 '20 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.