Check if user has permission to access Sharepoint Site using REST API or CSOM(e.g. provider-hosted addin)

Question

So I am trying to show a table that displays data from another server (via jQuery-Ajax for example). Now I have to secure the server that serves this data from unauthorized access. My idea would be that only users that have access to a specific SharePoint-site can access the REST-Api on the other server. So the process I intend to achieve is the following:

User goes on Sharepoint site ( let's call it www.corp-sharepoint.com/reporting )
The webpage returns content. In this content there is for example a script editor, that should then load the data from my other server ( let's say www.reportingdetails.com/details)
The browser makes an ajax-Request to www.reportingdetails.com/details and passes information about the current user
The server at www.reportingdetails.com/details gets the request, it then connects to SharePoint and asks whether the user logged in, whose information was passed by the browser, has access to page www.corp-sharepoint.com/reporting. If he has, the servers full fills the request and sends back the data, otherwise it sends a 401 error.

What would be a possible approach to establish this connection between SharePoint and my server mentioned in step 4?

Community · Accepted Answer · 2017-05-23 12:41:28Z

Assuming you're in a Microsoft environment (AD, IIS, etc.), set up your Reporting server to require windows-integrated authentication. Now you know what AD account is connecting to the reporting server.
Create a service account and give it sufficient access in your SharePoint site to check users and groups.
On your Reporting server, connect to SharePoint using the service account to authenticate, and check if the user should be given access to the site or not (based on the AD account of the logged in user from step 1).

Note: for simplicity, you could have the application pool on the reporting server run in the context of the service account, if this is possible in your environment. Otherwise, you'll have to keep track of the username (and password) and then create the credentials on the fly while connecting to SharePoint. For more info on creating these credentials, see this question: https://stackoverflow.com/questions/6382583/use-credentials-to-interact-with-the-client-object-model-of-sharepoint

Stack Exchange Network

Check if user has permission to access Sharepoint Site using REST API or CSOM(e.g. provider-hosted addin)

1 Answer 1

Your Answer

Hot Network Questions

Check if user has permission to access Sharepoint Site using REST API or CSOM(e.g. provider-hosted addin)

1 Answer 1

Your Answer

Sign up or log in

Post as a guest

Related

Hot Network Questions