Authenticate external systems against SharePoint REST services

Question

I want to make the SharePoint(on prem) REST services available for a number of other applications. The other applications are built on different platforms, Microsoft, Java, etc.

Applications should be able to update a list with new items(sounds simple =) ).

But my problem is authentication, to make successful REST calls, an access token is required. Where can i get that? Is it possible to set up Server to Server trust like you do with provider hsoted apps?

This article mentions authentication briefly : http://msdn.microsoft.com/en-us/magazine/dn198245.aspx

But it also says "The different ways you can authenticate a user from a Web or mobile application are outside the scope of this article".

The only way i got it to work(to read list items from an external console application) so far is when using the same certificate and clientId as an provider hosted app already installed in the site.

Answer 1

Each process (or thread) has an access token that describes its security context (or to put it simply, what user account it is "running as".)

As a simple example, Microsoft Excel sometimes uses web services to download information from SharePoint. Excel will run in the context of the logged in user (i.e. my own windows user account.) So if I have access to the SharePoint site, then the web service calls will take place seamlessly.

If you were writing your own desktop application in .NET, it would generally run in the user's context and therefore you would simply need to ensure the users running the program have access to the SharePoint site. If it's a client-side Java application, this should also be the case. If you need to plug in some credentials, simply use CredentialCache.DefaultCredentials:

http://msdn.microsoft.com/en-us/library/system.net.credentialcache.defaultcredentials.aspx

For server processes, in some cases you may need to create a new access token (this is somewhat akin to "running as a different user") Essentially, you are using a different user's security context. Typically, you would create an Active Directory account specifically for this purpose and then grant appropriate rights to the user account in SharePoint.

For more background on access tokens, check here:

http://msdn.microsoft.com/en-us/library/windows/desktop/aa374909.aspx