Sharepoint 2010 SSO with Forefront TMG

Question

We have a SharePoint 2010 site which we would like to SSO users into from an existing ASP.NET (Forms auth) website on which they are already authenticated. However the users need to be logged into SharePoint using Windows Authentication because they have access to PerformancePoint and Excel Services resources within SharePoint - these are tied to an SSAS cube which relies on AD accounts for data security.

We implemented a claims provider within this website which published a claim type of UPN (representing the user's AD account) and the users were able to log into SharePoint. However we then came across the problem that Excel Services / PerformancePoint were not fully claims aware, so all of the BI stuff within SharePoint didn't work. Having raised a case with MS about this it turns out that if you want to use this BI functionality (Excel, PerformancePoint) which is linked to SSAS you are limited to using Windows Authentication.

What we are now looking at doing is publishing SharePoint using Forefront as a reverse proxy, because apparently this means you can authenticate a user into SharePoint as a genuine Windows Auth /AD user. I have some questions around this:

• Is this feasible, and is Forefront TMG or UAG the most suitable?
• Can we SSO a user into Forefront using Claims-based authentication (with an AD UPN claim), but then have that user authenticated into SharePoint as a Windows Authenticated user?

So what we would be trying to achieve is:

• User logs into ASP.NET website using username and password
• User SSOs into TMG/UAG using claims authentication
• User visits SharePoint via TMG/UAG and is seen as an authenticated Windows user

Any help would be appreciated. It may be that there is a much better approach to this than what I am suggesting.

Answer 1

You're on the right track.

Yes, both TMG and UAG can be used to publish out SharePoint in the manner you need. The choice between which product to use depends on which feature set you need. Microsoft's Extranet Topologies diagram (PDF) compares ISA, TMG, and UAG (for Visio or XPS versions of this document, see the SharePoint 2010 Technical Diagrams page).

To my knowledge (but I have never tried this), you can create custom authentication providers for UAG (I'm not sure about TMG). Here is a TechNet article about creating custom authentication providers for UAG, but I cannot say for sure if this is what you should be looking for.

With UAG, you can have a user log in once and it can supply the SSO experience for all your pubslished applications. It has an interface similar to Citrix Access Gateway where users log in and can launch applications from a list of icons or you can enter URLs to reach the applications directly. This may be an alternative approach for you.