We have a SharePoint 2010 site which we would like to SSO users into from an existing ASP.NET (Forms auth) website on which they are already authenticated. However the users need to be logged into SharePoint using Windows Authentication because they have access to PerformancePoint and Excel Services resources within SharePoint - these are tied to an SSAS cube which relies on AD accounts for data security.
We implemented a claims provider within this website which published a claim type of UPN (representing the user's AD account) and the users were able to log into SharePoint. However we then came across the problem that Excel Services / PerformancePoint were not fully claims aware, so all of the BI stuff within SharePoint didn't work. Having raised a case with MS about this it turns out that if you want to use this BI functionality (Excel, PerformancePoint) which is linked to SSAS you are limited to using Windows Authentication.
What we are now looking at doing is publishing SharePoint using Forefront as a reverse proxy, because apparently this means you can authenticate a user into SharePoint as a genuine Windows Auth /AD user. I have some questions around this:
- Is this feasible, and is Forefront TMG or UAG the most suitable?
- Can we SSO a user into Forefront using Claims-based authentication (with an AD UPN claim), but then have that user authenticated into SharePoint as a Windows Authenticated user?
So what we would be trying to achieve is:
- User logs into ASP.NET website using username and password
- User SSOs into TMG/UAG using claims authentication
- User visits SharePoint via TMG/UAG and is seen as an authenticated Windows user
Any help would be appreciated. It may be that there is a much better approach to this than what I am suggesting.