Server-to-Server Authentication

To allow Lync 2013, Exchange 2013, and SharePoint 2013 systems to communicate securely with each other, the OAuth (OpenAuthentication) protocol is used. OAuth certificates allow the exchange of security tokens that grant access to resources for a time. Server-to-server authentication and authorization using OAuth is required for any of the integration features described in this chapter. For a full description of the process used to request and install an OAuth certificate for Lync Server 2013, see Chapter 11, “Dependent Services and SQL.”

After an OAuth certificate is installed on the first Lync 2013 Front End Server in the environment, the certificate is automatically replicated to other Lync Servers via Central Management Store replication, thereby establishing the required trust relationship between Lync servers. Similarly, Exchange 2013 and SharePoint 2013 use certificates to establish trust with other servers running the same software. However, for Lync 2013 to establish trust with Exchange 2013 and SharePoint 2013, the certificates on both sides must first be exchanged, and then the applications must also be configured as partner applications on both sides. A partner application is any application that Lync 2013 can exchange security tokens with directly, without the need for a third-party security token server.

To facilitate the certificate exchange between systems, each application features an authentication metadata document, which contains the certificates and other authentication information required to establish trust. The metadata documents are then exposed to the other application using a web service, as described in the sections that follow.