Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote 1 down vote favorite

We are trying to make it so that we can have a single Web Application that uses FBA that has 1-n site collections below that. However, we would like the permissions for each site collection to be unique in that the site collection administrators do not see any logins from the other site collections in the web application. Is this possible with forms-based authentication?

share|improve this question
what is the authentication provider behind FBA ? – Steve B Jul 6 '11 at 14:14
It will be using the SQL Membership provider. For added context, the farm would be internet facing, and each "client" would get a site collection. The "client" would ideally manage their own users and permissions. It seems this would be more manageable at the site collection level in terms of provisioning and URL management, etc. – CCCPSpy Jul 6 '11 at 17:08

2 Answers

up vote 0 down vote accepted

Out of the box I believe the only way to do this is with multi-tenancy, and then you are restricted with AD and separating accounts via OU's.

AD is required for 2010, so why not just create a customer OU structure and utilize that instead of FBA?

share|improve this answer
moving to AD have many implications... from CALs to open port. I assume CCCPSpy has a good reason to talk about FBA. – Steve B Jul 6 '11 at 14:13
You are going to require CALS for authenticated users, regardless of how you authenticate them. You may not require them for WSS 3.0 but you still require the Windows Server CALS that WSS is deployed on, which in turn gives you the CALS you need for Active Directory, which as stated should already be in use for a production deployment. – Jesus Shelby Jul 6 '11 at 14:35
what about SharePoint for internet scenarios ? if you have a SP used for internet, it have its own licence. What about the windows behind ? – Steve B Jul 6 '11 at 14:47
1  
Internet license is required for internet / extranet scenarios when you can not account for users accessing your deployment. However, for the users in your enterprise / company that will also be authenticating to the the system you still require CALS. There is no scenario where CALS are not required. Additionally, you must license the supporting systems and their CALS (OS, SQL, etc) and if you using internet licenses there are OS extender licenses to account for as well. – Jesus Shelby Jul 6 '11 at 14:58
Licensing is not the issue with AD. The main reason for FBA is we would like the users to be able to manage permissions on their own, and they wouldn't have access to the underlying servers or AD. It's to a degree a multi-tenancy setup, but each site collection is really mainly used as a file repository. – CCCPSpy Jul 6 '11 at 17:10
show 5 more comments
up vote 0 down vote

If you have access to the server you can restrict the people picker to only look up users in the sitecollection: http://technet.microsoft.com/en-us/library/cc261988(office.12).aspx

It should be possible to do a little powershell to use EnsureUser to prefill the needed account to allow the people picker to be usefull: http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spweb.ensureuser.aspx

This method is not restricting how can be added to the side, but from your question this seems fine.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.