SharePoint Apps - Do we ever need to Work with Windows Azure ACS when developing SharePoint apps for an Enterprise organization?

Question

Do we ever need to Work with Windows Azure ACS when developing SharePoint apps for the Enterprise organizations or it will be used only for the public facing sites?

Answer 1

If you're developing Provider hosted apps for on-premises SharePoint you have two options:

• High Trust
• Low Trust

High Trust
The trust between SharePoint and the App is based on a certificate which the App uses to sign the token in it's request to SharePoint, this certificate is then added to the SharePoint farm and SharePoint will trust that the User which specified in the token signed by the App is the user requesting the action. The app is then responsible for authenticating the user itself.

Low Trust
In this case the trust between SharePoint and the App is based on the app being registered in a Windows Azure AD, which the SharePoint installation trusts (which means that you'll need an Office 365 tenant (but you don't have to use it, so it can have a single user)) in that case SharePoint will authenticate the users send a token to the app, which will then use that token specifying the user to get a token for accessing SharePoint as that user.

The Low trust is a little harder to set up initially, but gives a better path if you ever want to move to Office 365.