I am trying to get an on-premise, provider-hosted application to be logged-in when the user is logged into SharePoint, and logged out when the user logs out of SharePoint, so essentially a "federated identity" scenario. This is a "high-trust" app.
I had thought that I could basically setup my application to use the Windows Identity Framework and have SharePoint communicate the user via claims authentication (something along the lines of How To: Build Claims-Aware ASP.NET MVC Web Application Using WIF
However, I cannot get that to work. After some further digging, I found How to: Create high-trust apps for SharePoint 2013 using the server-to-server protocol Among other things, it states:
- "The server-to-server STS isn't intended for user authentication."
- "In a high-trust app, there is no context token, even if you use the appredirect.aspx file"
- "If you’re using a high-trust configuration, your web application has to authenticate the user in the same way that SharePoint 2013 does (that is, the app is responsible for creating the user portion of the access token)"
How can I authentic my provider-hosted appmodel web application "in the same way that SharePoint 2013 does" and create the "user portion of the access token"?