Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am trying to improve site security and two options were requested:

  1. Enable SSL (quite obvious)
  2. Set special url in AAM for site administrators (lets say https://admin.spsite.com, usual url looks like http://spsite.com). The idea is that access to site from SP designer will be enabled for admin.spsite.com only.

I was told that p.2 is some kind of best practice. Can anyone explain me what is the benefit of having additional url in AAM?

Thanks in advance!

share|improve this question

2 Answers 2

It's all dependent on your situation and who your is audience.

A couple of scenarios where this works:

Internet facing site. HTTP Zone, Anon. Access and HTTPS Zone to edit content. Restrict access to edit HTTP via web policies in Central Admin. With this approach you need to educate your content authors about watching for posting HTTPS links to HTTP users. Not only does this break the user experience it opens you up to a number security exploits.

Intranet / Extranet. One zone handles native authentication for your internal users, one zone handles authentication for your extra net users. If you are using separate authentication sources you will not need web policies to restrict access. The drawback with this approach is when you start sharing links across zones it can be confusing (i.e. internal user emails their link to external users). 2010 supports multiple authentication methods in a single zone as well, achieving similar result by separating users via authentication mechanisms.

Generally speaking, in MOSS you have a default zone on HTTP, and if you wanted to use HTTPS you extended the webapp. This was because of issues with Search. This works like the first scenario, and we lock down HTTP so only the crawl account has access.

As far as locking down SP Designer, this approach works in 2007, but you need to make some modifications to block SPD on the zones you don't want it used. In 2010 you can use the built in permissions sets to achieve this, so you don't need AAM and different zones to achieve this result.

share|improve this answer

Answer to your question is here

share|improve this answer
1  
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  John Chapman Oct 19 '12 at 21:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.