OAuth authentication for SPFx solutions

Question

I am challenged by a SPFx based solution (WebPart as well as Commandbar-Extension). I have a set of APIs which are secured by OAuth. There is a dedicated authentication server, so I can't just use AAD to grab a token, but instead I have to access this authentication server.

So my challenge is: how can I provide a solution for an unknown amount of customers running not known SharePoint-tenants, while using OAuth? Since SPFx is a single-page-application-style solution I will have to provide a return-uri to the authentication server. And this return-uri has to be known by the authentication-server to be validated. But since I don't know who's going to use the application - I would need to allow all return-uris to *.sharepoint.com?

So my question is: there must be someone out there, who had the same problem. How would be a way to solve this challenge?

Answer 1

Hi @Henning Eiben
I will recommend you to connect to Azure AD-secured APIs in SharePoint Framework solutions. SharePoint Framework allows you to specify which Azure AD applications and permissions your solution requires, and a global or SharePoint administrator can grant the necessary permissions if they haven't yet been granted. By using the AadHttpClient, you can easily connect to APIs secured by using Azure AD without having to implement the OAuth flow yourself.

Please refer to the following document for more details
https://learn.microsoft.com/en-us/sharepoint/dev/spfx/use-aadhttpclient

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 2

Hi @Henning Eiben
I will recommend you to connect to Azure AD-secured APIs in SharePoint Framework solutions. SharePoint Framework allows you to specify which Azure AD applications and permissions your solution requires, and a global or SharePoint administrator can grant the necessary permissions if they haven't yet been granted. By using the AadHttpClient, you can easily connect to APIs secured by using Azure AD without having to implement the OAuth flow yourself.

Please refer to the following document for more details
https://learn.microsoft.com/en-us/sharepoint/dev/spfx/use-aadhttpclient

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---