Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 4 down vote favorite
2

We're planning a sharepoint intranet which will be acceded directly from our LAN, however it should be accesible from the Internet, too. What would be the best authentication method available for this purpose?.

NOTE: A digital certificate will be established for accesing the IIS site to secure communication.

Thank you

share|improve this question
1  
Do you want to allow unauthenticated users to access certain sites within your internal web application? Or, will there be external users that need to be authenticated using FBA? Or, are these internal users that just need to access your site when not on the internal network? – Laurie Jul 6 '11 at 0:23
The idea is not to allow anonymous users to have access to the web application, but rather allow the same internal users to access safely and securely through the Internet. Eventually, could exist some external users (providers, associates etc.) to access in a restricted way to the site. thank you. – haroldmoma Jul 6 '11 at 0:29

2 Answers

up vote 2 down vote accepted

To allow your internal users to access the site from off-site, you should set them up with VPN access to the network.

As far as advice on setting up access for external users, you will need to know more about who they are and what they will need to access before you can make a good decision on that.

If you will be using the same site for internal and external, you can extend your existing web application, provide another url for your external users, use form-based authentication for them to log in, and place those users into SharePoint groups in order to manage permissions.

How to: Expose a SharePoint Application to the Extranet and Use Forms-Based Authentication

However, depending on your use cases, you may decide to create a separate site for your external users and use content deployment to move data appropriate to those users to that site.

share|improve this answer
Thanks for your answer. I think your last idea is sound, therefore I will have to look at content deployment to move forward in that direction. – haroldmoma Jul 6 '11 at 1:58
up vote 6 down vote

You could also use the Microsoft Threat Management Gateway 2010 (TMG 2010) to publish your SharePoint intranet in a secure way. It could for instance be published on a Web address like https://intranet.yourcompany.com

Now, my suggestion does of course require that you are using the TMG as a firewall between the internet and your internal network. But I can only recommend that - it is a very strong product. For authentication just use Windows authentication or Windows claims authentication for your Web application and configure the TMG with HTML Form Authentication. The TMG will then collect the user credentials via a HTML form, similar to the one used by Outlook Web Access. No need to mess around with forms based authentication in SharePoint!

The TMG can also provide VPN access to your internal network. But for accessing the intranet I would prefer to also be able to access it publicly over SSL without the need for a VPN connection.

Configuring the TMG and publishing SharePoint sites, require many steps. See the article Publish a web farm using TMG 2010 for detailed instructions

share|improve this answer
This tends to be more secure than just giving a user open VPN access to the entire network. While TMG / UAG work very well, you can utilize other third party reverse proxies if you have access to those (even some of those open source flavors) depending on budget requirements. – Jesus Shelby Jul 6 '11 at 14:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.