I am experienced with developing SharePoint 2007 and 2010 solutions, and am working to get into SharePoint 2013 development.
The requirement from our customer is that the App can only be deployed as an auto-hoted or SharePoint-hosted (no Provider-hosting) app.
We provide a platform and each of our customer is issued one or more sets of credentials for use with OAuth authentication. This allows us them to generate limited tokens for each user visiting, without giving them permanent access.
Since everything is client-side, I don't see any way to "hide" these credentials from the user. What is the best practice in situations like this? It would be a tiny bit of server-side code to generate tokens, but I don't want to put the OAuth credentials in the front-end code for the users to (ab)use.
The individual users do not have access to our API or services (the idea behind giving them these master credentials is that they don't have to create/connect each user to our system, and unfortunately we don't have direct AD integration or similar).
Is this even possible? Can the user send anything to us directly that would allow us to verify them as being part of a specific SharePoint site?