The new SharePoint 2013 App model extends native SharePoint applications into the cloud, allowing developers to write applications that interact with SharePoint data remotely. With these new capabilities come additional challenges for managing security and user authorization via OAuth. Administrators, IT professionals, and developers should attend this session to familiarize themselves with the core concepts behind OAuth in SharePoint 2013, learn how best to configure and manage OAuth in their environment, and discover how OAuth is used in the SharePoint app model.

1. Who Are You and What Do You Want?
Working with OAuth in SharePoint 2013

2. CKS:DEV
The
SharePoint
Cowboy
Patterns
&
Practices
Eric Shupps
www.sharepointcowboy.com eshupps@binarywave.com facebook.com/sharepointcowboy @eshupps

3. Introduction
Farms
On Premise
Apps
OAuth
+
SharePoint
Servers
Cloud
Apps
Agenda

4. INTRODUCTION

5. authorization

7. User requests access App requests
Request Token
Provider returns
Request Token
App builds auth link
w/ Request Token
User requests URL +
Request Token
Provider returns
access token
User requests URL +
Access Token
App validates access
token
Access token
validated
User granted
access
1
2
3

8. User requests access App requests
Request Token
Provider returns
Request Token
App builds auth link
w/ Request Token
User requests URL +
Access Token
App validates access
token
Access token
validated
User granted
access
1
2

9. OAuth in SharePoint 2013

11. Manages identity information for principals (STS)Identity Provider
Handles requests for trusted identity claimsSecurity Token Service
Identity provider associated with a web applicationIdentity Token Issuer
Trusted resource (farm, server, etc.)Security Token Issuer
Resource information and signing certificate (JSON)Metadata Endpoint
Used to request permission to protected resourceRequest Token
Used by App to access resource on behalf of userAccess Token
Operation scope for authorizationRealm
Cloud-based security token service (IP-STS)Azure ACS

14. Farms

15. COLLABORATE
My Sites
Content
Distributed Roles
Enterprise Features
Managed Metadata
Search
Shared Service Applications
Request Management

16. Consumer
Export Root & STS Certificates
Copy Certificates
Import root certificate(s) and
create trusted root authority
Provider
Export Root Certificate
Copy Certificates
Import STS Certificate
Create Trusted Service Token
Issuer
Import root certificate(s) and
create trusted root authority

17. Consumer Provider
Create Trusted Root Authority
Set Authentication Realm
Create Trusted Security Token
Issuer
Create App Principals
Create Trusted Root Authority
Create Trusted Security Token
Issuer

19. Servers

20. Other
Lync
Office Web Applications
Workflow
Servers
Exchange

21. Certificates Metadata
Create security token issuer
Assign app principal permissions
Install client components
Export/Import certificates
Create root authorities
Execute configuration scripts
Execute configuration scripts

23. Apps

24. App establishes context
SP validates S2S trust
App requests access token from SP
Browser POSTS parameters to App
SP returns parameters
User browses to App

25. User Permissions
App behaves in context of user
Consistent across all requests
Specific access rights and
scope requested by app
App Only Permissions
Granted on app installation

26. Establish client context
Get access token with S2S
Get claims from Windows identity
Get request parameters

28. CLOUD

29. App establishes context
ACS provides access token
App requests access token from ACS
Browser POSTS request token to app
SP sends request tokens to browser
SP gets request token from ACS
User browses to app

30. Get client context from SP with access token
Get access token
Read and validate context token
Parse out Context Token
Get POST parameters from SP

32. Description Link
OAuth Working Group http://oauth.net/
OAuth Resource Guide http://bit.ly/14CWPNb
Authorization and authentication for apps in SharePoint 2013 http://bit.ly/16f8WFh
Setting up an OAuth trust between farms in SharePoint 2013 http://bit.ly/12Yr7e3
Plan for server-to-server authentication in SharePoint 2013 http://bit.ly/1chAgFl
What’s new in authentication for SharePoint 2013 http://bit.ly/1e6KaYv
Creating High-Trust apps with S2S http://bit.ly/18RL8uL