is it possible to add an oauth2 based user authentication provider to sharepoint server

Question

Hi,

I should start by saying this is the first time i'm dealing with sharepoint user auth. One of my customer requires users from different identity providers to be able authenticate their users to sharepoint sites within the organization.

Currently we are using the standart AD LDAP auth method but I'm looking for a way to add another auth provider. The information i have is as follows:

They have an oauth2 based identitiy provider system in-house developed software. And they told me they have ldap as authentication provider. I also recieved a postman json file for oauth2 protocol they used. But that doesn't mean much to me at this point.

Please let me know if the above information is enough. If not i'll ask for more information that you might require to provide a solution.

edit: i added json i was provided with.

edit2: the said ldap integration was for ad user to authenticate through custom oauth2 based identity provider. At first i thought it would work between oauth2 and sharepoint but that isnt the case.

edit3: would it be possible to create asp.net forms auth page that talks with oauth2 protocols given in json file below? And add that fba to sharepoint auth provider list?

Answer 1

SharePoint natively supports FBA or more likely what you want, SAML 1.1. For SAML, you need to integrate it with the customer's identity provider (i.e. AD FS or some other cloud-based IdP). The IdP prompts the user for authentication -- SharePoint only handles authorization.

https://learn.microsoft.com/en-us/SharePoint/security-for-sharepoint-server/plan-user-authentication#plan-for-saml-token-based-authentication

Answer 2

Hi @HarunKara-9729 ,

I agree with trevor's suggestion.

In this situation, we could use SAML Claims Mode to get SAML Access Token from external custom Authentication Provider and authenticate user.

Here is a official guidence about setting up SAML Authentication and create Trust identity Provider for your reference:

Implement SAML authentication

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Thanks for the answers, I really appreciate it. I will attempt to impelement a solution by the end of this week. And I will post the results and flag an answer accordingly.

Answer 4

So I think I need to create a custom identitiy provider that is saml based following this link: https://learn.microsoft.com/en-us/previous-versions/office/developer/sharepoint-2010/ff955607(v=office.14)?redirectedfrom=MSDN

After creating that provider i will add as IP-STS to sharepoint server farm. And that auth provider will talk to oauth2 identity provider in the background. I found some links for integration saml to oauth2, here are the links:

https://wiki.scn.sap.com/wiki/display/Security/Using+OAuth+2.0+from+a+Web+Application+with+SAML+Bearer+Assertion+Flow
https://blog.scottlogic.com/2015/11/19/oauth2-with-saml2.html

Am i on the right path? I have no idea what i am doing :) I am in need of your opinion, thanks!

@Jerryzy-MSFT @trevorseward

Answer 5

Hi @HarunKara-9729 ,

You are in the right way.

And here is a video which explain the OAuth Implemention, hope will be helpful to you:

SharePoint 2013 OAuth implementation