I am using SharePoint 2010 Server.
I am trying to understand (and test out) all the various options for using different authentication sources for internal and external users on a site that can be considered an "extranet".
It is similar to the "PartnerWeb" discussed here: http://technet.microsoft.com/en-us/library/cc262350.aspx#section6
I want to allow internal company users, customers, and other companies we are teaming with to access and collaborate in a site collection and allow varying levels of access (including no access) to some sites, list, libraries, pages, etc.
One of the current architectures I am leaning towards, has internal users being authenticated using the internal Active Directory and the external users being authenticated using an external source (an external AD, SQL accounts, or something like Windows Live, etc).
SP 2010 supports multiple Authentication sources per zone. So, unlike SP 2007, I can configure the one web app to use two separate sources of authentication without extending the web app into a second zone and creating a second URL for the the site.
My question is... is there any reason I would WANT to extend it to another zone? The permissions control at the zone level seems very high level (allow anonymous, read-only, etc) and it seems like for my use case I would have to configure permissions at a lower level anyway. (i.e. I could not specify for a site to "don't let anyone from the extranet zone see any content on just this site). I don't want to have anonymous access for the whole site and I want external users to be able to contribute (discussions, etc) and not have read-only access.
So although I can set up another URL (alternate access mapping) for external users, I am having trouble understanding how I would actually use that information within my sites to grant/deny access.
Update I did just see something in another thread, that points out that using two separate zones (and URLs) for the web app with two authentication sources will eliminate the drop down menu you get when you have multiple authentication sources configured on a single zone. I have been assuming I would be able to change that default login page and add some logic to it to prevent that without having to extend to another zone just to achieve the elimination of the drop down. I planned to have a more branded looking FBA page anyway.