This repository has been archived by the owner on Jan 19, 2021. It is now read-only.
Feature: S2S user delegation in Hightrust app scenario #2363
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What's in this Pull Request?
This PR contains an enhancement whith which it's possible to create an App Delegation token in an Hightrust configuration to act as specific user (behalf-of) within a SharePoint connection. Up to now this scenario was only possible with an
WindowsIdentity
object instance available, which is not the case if the addin is deployed in an environment which isn't connected to an Active Directory environment (e.g. Azue WebApp) and is employing other authentication themes like JWT Bearer or SAML tokens.This PR now provides new methods on
Core/OfficeDevPnP.Core/AuthenticationManager.cs
which allows to pass the SID or the UPN for an user for creating an impersonation (delegation) token. The SID is just as unavailable in the above scenario as theWindowsIdentity
object instance but the UPN typically is, because the UPN is normally used in JWT or SAML token to identify an incoming user.With this extension it is possible to host a SharePoint Add in a "domain-less" environment, like as an Azure WebApp, utilize modern authentication methods and still perform impersonation on a SharePoint system in an Active Directory domain.