This document discusses developing hybrid SharePoint apps that can run both on-premise and in the cloud. It covers the new app model and authentication options for cloud, on-premise, and hybrid scenarios. The key aspects are using OAuth for cloud authentication, certificate-based trust for on-premise, and connecting on-premise farms to apps in the cloud for hybrid scenarios. Visual Studio 2013 tools simplify building single-codebase hybrid apps that work on-premise and in the cloud.

1. Developing hybrid SharePoint apps
that run on-premise and in the cloud
Bram de Jager
Macaw, The Netherlands
Microsoft Certified Solutions Master: SharePoint

2. Agenda
• Why do we need a new authentication model?
• Where does the new App model fit in?
• Inside OAuth
• Hybrid Apps
• Wrap-up

3. ANOTHER AUTHENTICATION MODEL?!
Why do we need a new authentication model?

6. WHERE DOES THE (NEW) APP MODEL
FIT IN?
Developing hybrid SharePoint apps that run on-premise and in the cloud

7. Customization Options
Sandbox
 Hosted in isolated
process
 Limited server side
SharePoint API
access
 No external
service calls
Full Trust
(a.k.a. Farm)
SharePoint
Apps
 Server side
SharePoint API
access (SSOM)
 Customizations to
file system or
servers
 Hosted in same
process as
SharePoint
 Classic model since
2007
 New Apps model
 Deployed from
corporate catalog
or Office Store
 Runs outside of
SharePoint process
 Can be deployed
on Azure, IIS,
Apache,…
 Simple install and
upgrade process
Code sandboxed
solutions are
deprecated in
SharePoint 2013

8. Cloud, On-Premise, and Hybrid
• Cloud
– Azure AD (WAAD) in O365
– Apps use OAuth
• On-Premises
– Apps user cert based trust
– On-prem to on-prem
• Hybrid
– Combination of Azure AD
and on-prem SharePoint
Azure AD
Office 365App
App SharePoint

9. Bram de Jager
SharePoint-hosted apps
on-premise and online

10. Scenario
• Build simple SharePoint-hosted app (list count)
• Deploy to on-premise App Catalog
• Deploy to online App Catalog
• Show lists in SharePoint Client Browser

11. Limitations SharePoint-hosted
• No custom server-side code (only HTML & JavaScript)
– Only supports current user in a page
– Can’t use elevated privileges
• No off-box logic
– Based on event in SharePoint
– No timer jobs available

12. INSIDE OAUTH
Developing hybrid SharePoint apps that run on-premise and in the cloud

13. Access token and issuer

14. OAuth-authenticated request
POST http://teams.contoso.com/sites/dev/_api/client.svc/ProcessQuery HTTP/1.1
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJhdWQiOi...
Content-Type: text/xml
Host: teams.contoso.com
Content-Length: 615
Expect: 100-continue
Accept-Encoding: gzip, deflate
<Request AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" LibraryVersion="15.0.0.0"
ApplicationName=".NET Library"
xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009"><Actions><ObjectPath Id="41"
ObjectPathId="40" /><ObjectPath Id="43" ObjectPathId="42" /><Query Id="44"
ObjectPathId="42"><Query SelectAllProperties="false"><Properties><Property Name="Title"
ScalarProperty="true" /></Properties>…

15. Decoded access token
{
"typ":JWT
"alg":RS256
"x5t":34-64-C5-BD-D2-BE-7F-2B-61-12-E2-F0-8E-9C-00-24-E3-3D-9F-E0
}
{
"aud": "00000003-0000-0ff1-ce00-000000000000/teams.contoso.com@3c2483eb-b061-4985-9bac-da7989c7f820",
"iss": "de89e8c4-9f67-48b7-bf42-368af4db1369@3c2483eb-b061-4985-9bac-da7989c7f820",
"nbf": "1372429268", (Friday June 28 2013 23:44:38)
"exp": "1372429868", (Friday June 28 2013 23:56:28)
"nameid": "s-1-5-21-785527463-2883119929-1484527358-500",
"nii": "urn:office:idp:activedirectory",
"actortoken":
"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjNUYnY3cThmZzhGVWg5YkdyZnVtS3FUR1VZSSJ9.eyJhdWQiOiIwMDAwMDAwMy0
wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvdm0tc3AtMDFAM2MyNDgzZWItYjA2MS00OTg1LTliYWMtZGE3OTg5YzdmO
DIwIiwiaXNzIjoiYTU4ZTIzNDctMGVhZC00YmEwLWI0YjctNzUxMjBhYTA5ZTRlQDNjMjQ4M2ViLWIwNjEtNDk4NS05YmFjLWRhNzk4OW
M3ZjgyMCIsIm5iZiI6IjEzNzI0MjkyNjgiLCJleHAiOiIxNDMyNDI5MjY4IiwibmFtZWlkIjoiZGU4OWU4YzQtOWY2Ny00OGI3LWJmNDItMzY4
YWY0ZGIxMzY5QDNjMjQ4M2ViLWIwNj…"
}

16. Online authentication

17. On-premise authentication

18. Bram de Jager
Building a High-Trust (S2S)
app on-premise

19. Scenario
• Setup the server-to-server (S2S) trust
• Build a High-Trust app
• Show the “on behalf of”

20. HYBRID APPS
Developing hybrid SharePoint apps that run on-premise and in the cloud

21. Hybrid app

23. Office Developer Tools support
• In Visual Studio 2012 the app checks availability of
the ContextToken (present or not)
– TokenHelper class, app helper class
• Visual Studio 2013 with the new release of Office
Developer Tools introduces a new class
– SharePointContext class, takes care of switching
between ACS or S2S trust

24. Bram de Jager
Building a Hybrid app

25. Scenario
• Set-up trust between on-premise SharePoint Farm
and Azure Control Services (ACS)
• Build Hybrid SharePoint app that runs in
– SharePoint on-premise
– SharePoint Online

26. WRAP UP
Developing hybrid SharePoint apps that run on-premise and in the cloud

27. Summary
• The new App model is designed for both cloud and on-
premise
• Use the high-trust (S2S) authentication model for on-
premise scenarios
• In a hybrid environment connect on-premise SharePoint
farms to Apps in the cloud
• Build a single codebase hybrid App that works both on-
premise as in the cloud

28. Key takeaways
• Understanding authentication flow is a must for
every developer
• Don’t use Visual Studio 2012 any more
• Use Visual Studio 2013, make life a lot easier!

29. Resources
• Decode JWT, http://openidtest.uninett.no/jwt
• How to: Use an Office 365 SharePoint site to authorize
provider-hosted apps on an on-premises SharePoint site,
http://msdn.microsoft.com/en-
us/library/office/dn155905(v=office.15).aspx
– Microsoft Online Services Sign-In Assistant for IT Professionals
RTW (64-bit), http://www.microsoft.com/en-
us/download/details.aspx?id=41950
– Microsoft Online Services Module for Windows PowerShell (64-
bit), http://go.microsoft.com/fwlink/p/?linkid=236297

30. Thank you
• http://bramdejager.wordpress.com
• @bramdejager
• bram.de.jager@macaw.nl
• http://spcb.codeplex.com