I am trying to get an on-premise, provider-hosted application to be logged-in when the user is logged into SharePoint, and logged out when the user logs out of SharePoint, so essentially a "federated identity" scenario. This is a "high-trust" app.

I had thought that I could basically setup my application to use the Windows Identity Framework and have SharePoint communicate the user via claims authentication (something along the lines of How To: Build Claims-Aware ASP.NET MVC Web Application Using WIF

However, I cannot get that to work. After some further digging, I found How to: Create high-trust apps for SharePoint 2013 using the server-to-server protocol Among other things, it states:

  • "The server-to-server STS isn't intended for user authentication."
  • "In a high-trust app, there is no context token, even if you use the appredirect.aspx file"
  • "If you’re using a high-trust configuration, your web application has to authenticate the user in the same way that SharePoint 2013 does (that is, the app is responsible for creating the user portion of the access token)"

How can I authentic my provider-hosted appmodel web application "in the same way that SharePoint 2013 does" and create the "user portion of the access token"?

  • It is looking like I may have to create my own trusted identity provider to get this scenario to work. – Nathan Nov 19 '13 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.