I understood that OAuth is used only to authenticate the SharePoint apps but not the users. In that case, how does the credential shared between the host-web and app-web? and why does it required as both the host-web and app-web will be hosted on the same cloud infrastructure?

Does it mean that Windows Azure ACS is configured for the Office365 SharePoint applications by default? Because, I did not do anything on Windows Azure ACS but still I could consume the Autohosted apps.

1 Answer 1


OAuth is used to authenticate the App such that SharePoint can enforce the permission for the App.

So when using an App there are two sets of permission in action:

  • The permission of the current user
    • By default the user has the same permission on the host-web and app-web due to the app-web inheriting permissions
  • The permission of the App
    • By default the App has full control of on the App-web
    • The only permissions the App has on the Host-web are the ones specified in the App Manifest and granted by the person installing the app (which is required to have these permission herself)

When SharePoint calls an App it'll pass a token which allows the App to get a token identifying itself and the current user. In case of a non SharePoint hosted app it may also request a token identifying only the app with no user (requires that this was requested in app manifest)

All access checks in SharePoint will the check that both the App and the current user (unless app only token) has permission to do what is requested. If either fails the app get access denied.

This means that even though the current user is Farm Admin, the app only has the permission on the Host-web that it requested, which is a lot safer that Farm Solutions.

The App only token (not for SharePoint hosted apps as it requires server side code) then allows the app to do actions on the Host-web even though the current user doesn't have these permission, which is something we lacked in Sandboxed solutions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.