One of my customer has a requirement which is to allow basic authentication because a outdated SSO and reverse proxy tool (changing this is not an option today). This is true for external access (both employees and partners), internal access is direct to the server, then it can use Kerberos.
Because Basic authentication can be a major security hole, I'd like to have in my SP farm two "endpoints" :
- one for internal access, that accepts only Kerberos
- one for external access, that accepts only basic. I want to allow only the reverse proxy server to access this endpoint.
What is the best way to achieve this ?
Because the basic authentication relies on HTTP headers, I can't use a firewall rule. As my application url will be the same for both internal and external access (http://myapp.mycompany.com), I can't use sharepoint zone to defines these two endpoints. As a best practice, I don't want to set up listening IP addresses directly in IIS...
thanks in advance for any advice.