Sharepoint Proxied Queries

Question

I am writing a web app in PHP for our Joomla CMS that needs to query a SharePoint web service that is locked down under SSL/HTTPS.

My server is also running SSL and user's authenticate to MY web server and provide credentials (a company issued cert). So now I know who they are.

I need to be able to query our SharePoint server (different servers and different people managing them) for this user but I cannot authenitcate to SharePoint as this user.

I need to present a high level application cert that can see everything in SharePoint and tell SharePoint who I'm doing the search for (the user). And then have SharePoint return only those items (or lists) that the user is allowed to see. This is a proxied search, correct?

I'm probably not using the correct search terms in Google, but I cannot find anything on the web that might help me. I'll need to coordinate with the SharePoint people to set this up, but I'm not even sure what to tell them I need. Any help would be greatly appreciated.

Answer 1

I learned a few things that are probably obvious to people familiar with SSL, Certificates and the way browsers talk to each other.

First of all, the client is sending the web server his public key and secure connection request signed with his private key. This is in order to authenticate to the web server.

Now the web server has his public key, but in order to open a trusted connection to the SharePoint server, he would have to sign the secure connection request with his private key again. But all I have is his public key. I have no way of establishing a secure connection in the client's name.

So I was planning to use a proxy account that can see everything, tell the SharePoint server that I am proxying a request for this client (and attach the client's identity - in a form that SharePoint can recognize, his Distinguished Name.

Unfortunately, the SharePoint software or the people administering our SharePoint instance have no clue how to take a proxy request and act on it. So I gave up.

TL;DR - It's too hard for our SharePoint admins to do this.

I'm gonna leave the question out here for future answers. Maybe someone, somewhere has done this and can enlighten my admins...