SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It only takes a minute to sign up.
Sign up to join this community
I understood that OAuth is used only to authenticate the SharePoint apps but not the users. In that case, how does the credential shared between the host-web and app-web? and why does it required as both the host-web and app-web will be hosted on the same cloud infrastructure?
Update
Does it mean that Windows Azure ACS is configured for the Office365 SharePoint applications by default? Because, I did not do anything on Windows Azure ACS but still I could consume the Autohosted apps.
OAuth is used to authenticate the App such that SharePoint can enforce the permission for the App.
So when using an App there are two sets of permission in action:
When SharePoint calls an App it'll pass a token which allows the App to get a token identifying itself and the current user. In case of a non SharePoint hosted app it may also request a token identifying only the app with no user (requires that this was requested in app manifest)
All access checks in SharePoint will the check that both the App and the current user (unless app only token) has permission to do what is requested. If either fails the app get access denied.
This means that even though the current user is Farm Admin, the app only has the permission on the Host-web that it requested, which is a lot safer that Farm Solutions.
The App only token (not for SharePoint hosted apps as it requires server side code) then allows the app to do actions on the Host-web even though the current user doesn't have these permission, which is something we lacked in Sandboxed solutions.
