SPTECHCON - Who are You and What Do You Want - Working with OAuth in SharePoint 2013
0 likes947 views
This document discusses OAuth authentication in SharePoint 2013. It provides an overview of OAuth and how it manages identity and handles requests for trusted identity claims. It also covers how OAuth is used for on-premise apps and cloud apps to authorize access between servers, farms, and apps. The document includes an agenda that outlines key concepts like security token services, access tokens, realms, certificates and metadata configuration needed to implement OAuth authentication.
SPTECHCON - Who are You and What Do You Want - Working with OAuth in SharePoint 2013
- 1. Who Are You and What Do You Want? Working with OAuth in SharePoint 2013
- 2. CKS:DEV The SharePoint Cowboy Patterns & Practices Eric Shupps www.sharepointcowboy.com [email protected] facebook.com/sharepointcowboy @eshupps
- 4. INTRODUCTION
- 7. User requests access App requests Request Token Provider returns Request Token App builds auth link w/ Request Token User requests URL + Request Token Provider returns access token User requests URL + Access Token App validates access token Access token validated User granted access 1 2 3
- 8. User requests access App requests Request Token Provider returns Request Token App builds auth link w/ Request Token User requests URL + Access Token App validates access token Access token validated User granted access 1 2
- 9. OAuth in SharePoint 2013
- 11. Manages identity information for principals (STS)Identity Provider Handles requests for trusted identity claimsSecurity Token Service Identity provider associated with a web applicationIdentity Token Issuer Trusted resource (farm, server, etc.)Security Token Issuer Resource information and signing certificate (JSON)Metadata Endpoint Used to request permission to protected resourceRequest Token Used by App to access resource on behalf of userAccess Token Operation scope for authorizationRealm Cloud-based security token service (IP-STS)Azure ACS
- 14. Farms
- 15. COLLABORATE My Sites Content Distributed Roles Enterprise Features Managed Metadata Search Shared Service Applications Request Management
- 16. Consumer Export Root & STS Certificates Copy Certificates Import root certificate(s) and create trusted root authority Provider Export Root Certificate Copy Certificates Import STS Certificate Create Trusted Service Token Issuer Import root certificate(s) and create trusted root authority
- 17. Consumer Provider Create Trusted Root Authority Set Authentication Realm Create Trusted Security Token Issuer Create App Principals Create Trusted Root Authority Create Trusted Security Token Issuer
- 19. Servers
- 21. Certificates Metadata Create security token issuer Assign app principal permissions Install client components Export/Import certificates Create root authorities Execute configuration scripts Execute configuration scripts
- 23. On-Premise Apps
- 24. App establishes context SP validates S2S trust App requests access token from SP Browser POSTS parameters to App SP returns parameters User browses to App
- 25. User Permissions App behaves in context of user Consistent across all requests Specific access rights and scope requested by app App Only Permissions Granted on app installation
- 26. Establish client context Get access token with S2S Get claims from Windows identity Get request parameters
- 29. Cloud Apps
- 30. App establishes context ACS provides access token App requests access token from ACS Browser POSTS request token to app SP sends request tokens to browser SP gets request token from ACS User browses to app
- 31. Get client context from SP with access token Get access token Read and validate context token Parse out Context Token Get POST parameters from SP
- 34. Description Link OAuth Working Group http://oauth.net/ OAuth Resource Guide http://bit.ly/14CWPNb Authorization and authentication for apps in SharePoint 2013 http://bit.ly/16f8WFh Setting up an OAuth trust between farms in SharePoint 2013 http://bit.ly/12Yr7e3 Plan for server-to-server authentication in SharePoint 2013 http://bit.ly/1chAgFl Whatâs new in authentication for SharePoint 2013 http://bit.ly/1e6KaYv Creating High-Trust apps with S2S http://bit.ly/18RL8uL Using O365 to Authorize On-Premise Apps http://bit.ly/1fvv1Bo