SharePoint Provider Hosted App Credentials to Consume Web API

Question

I have a SharePoint Online website with a provider-hosted app, and a Web API service which is secured using Azure Active Directory.
I would like to consume the Web API service from the SharePoint app.
Since the user is already authenticated in the SharePoint context, I would like to use their credentials and to "carry" it onwards to the Web API service (instead of prompting the user for username and password).

My Web API is registered in the AAD, and I noticed that the SharePoint app appears in the AAD as well (as a "consented app").

Is it somehow possible to allow access tokens issued for the consented app, to be used when accessing the Web API? Is there any other solution for "carrying" credentials from the SharePoint context to a third-party service?

Thanks!

Answer 1

Yes this should be possible, but if you are using the SharePoint15 app model for your provider hosted web app, re-using the user context may be challenging. That said you should be able to use OAuth2.0 to call into our your Azure AD secured web API from your web app, and although consent may be requested, the user should not need to sign in again.

There are plenty of examples on github on how to use Azure AD (and the ADAL client library) to call into a web API. This one is likely most appropriate: https://github.com/AzureADSamples/WebApp-WebAPI-OpenIDConnect-DotNet although it also uses OpenID Connect for sign in (using Azure AD accounts), before using the OAuth2.0 code flow to call the web API. In the call to the web API, the access/Jwt token will contain info about the client app and the signed in user.

The latest O365 REST APIs allow you to use the same OAuth2.0 framework provided by Azure AD. This would allow you to build a web app that can call Files/SharePoint, Mail/Calendaring/Contacts, and Azure AD Graph, as well as your own or other web APIs: https://msdn.microsoft.com/office/office365/HowTo/platform-development-overview

HTHs,