SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my customer has a requirement which is to allow basic authentication because a outdated SSO and reverse proxy tool (changing this is not an option today). This is true for external access (both employees and partners), internal access is direct to the server, then it can use Kerberos.

Because Basic authentication can be a major security hole, I'd like to have in my SP farm two "endpoints" :

  • one for internal access, that accepts only Kerberos
  • one for external access, that accepts only basic. I want to allow only the reverse proxy server to access this endpoint.

What is the best way to achieve this ?

Because the basic authentication relies on HTTP headers, I can't use a firewall rule. As my application url will be the same for both internal and external access (, I can't use sharepoint zone to defines these two endpoints. As a best practice, I don't want to set up listening IP addresses directly in IIS...

thanks in advance for any advice.

share|improve this question
up vote 0 down vote accepted

Create a web application for internal, set it up with Kerberos, then extend the web application, and set up the extended web application with Basic auth. You'll end up with two URLs like this (or whatever you want them to be):

They will both point to the same content database. So if you create a site on external called /siteone, then /siteone will also exist on internal, as they are both pointing to the same content database.

Each of them can be set up with completely different authentication scenarios - you can use Basic Auth on one and Kerberos on the other, as you want - they could even point to completely different user stores if you want. Then you can go into IIS and set a rule for the external site so that external can only be accessed from your reverse proxy server.

More information on Extending a Web Application:

share|improve this answer
I can't use two urls, as I said in my first post. The customer scenario is to allow their employee to be able to connect to the application from any place (using the custom sso and reverse proxy). If I use two urls, users will face two applications (regarding email alerts, etc.). That's why I posted my question... because the well documented scenario can't apply in my case. – Steve B Mar 21 '11 at 14:18
If the same users will be accessing the site both internally and externally, and if you want to have both external and internal access behaving in the same manner in regards to incoming links from email alerts, why not just set up one web application, using a single authentication scheme? (choosing either Kerberos or your SSO setup) – CodeThug Mar 21 '11 at 14:41
sorry for the delay, I didn't get the notification of the answer ... – Steve B Jun 29 '11 at 8:36
these authentication scheme is a requirement from the customer. However, getting new info from him : the sso can simulate kerberors authentication. So, from the SP perspective, it's transparent. thx for the help – Steve B Jun 29 '11 at 8:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.