问题

The Goal

Access an on-premise SharePoint data with REST requests from a mobile application based on Apache Cordova using OAuth.

What I have tried so far

1. Azure Mobile Services / Hybrid Connection / AAD / ADAL

Similar to the blog post Access SharePoint on behalf of the user, but with an on-premise server instead of O365:

Client side log-in using ADAL for Apache Cordova.
Mobile Service that is connected to the on-premise server through hybrid connections.
Using ADAL.net to acquire a token for the SharePoint server using the token obtained in step 1.

This works fine except step three, since there is no sort of connection between the on-premise server and AAD, hence no token can be acquired.

2. Same as above plus Azure Application Proxy

We've setup the Azure Application Proxy as described by Kirk Evans in this post. The Azure AD application for the mobile service is given access permission to the application for the Application Proxy (in the same Azure AD tenant).

Now steps one to three are working fine. We've been able to obtain a token using the Application Proxy URL as resource. Then we've tried to execute a REST request using the token as follows:

GET https://<server>.msappproxy.net/_api/web/title
Authorization: Bearer <the token>
Accept: application/json;odata=verbose

But this sends a 302 redirect to https://login.microsoftonline.com. I've tried to emulate the handshake being done when using the browser by posting the token as "id_token=" to the app proxy, but this seems a little far fetched and not intended by the Azure Application Proxy setup.

I think the missing part is to enable token based authentication for the on-premise SharePoint. I could not find anything on how to do that. I was considering investigating in a setup for SharePoint Apps (now add-ins) on the on-premise server. I doubt that this will solve the issue. I tried to connect the server to AAD using the follwing method: How to: Use an Office 365 SharePoint site to authorize provider-hosted apps on an on-premises SharePoint site. Again this was more of a shot in the dark.