Same public URL on two zones?

Question

I have a default and an extended "Extranet" zone on one of my web application. I would like to assign a single URL "https://Name.myDomain.com" to both zones. Additionally I also want to be able to differentiate the authentication. 1. If an external user browses https://Name.myDomain.com, he must be shown the FBA form to sign in. 2. On the other hand if a internal user browses https://Name.myDomain.com, he should be let through using windows authentication and not presented the default login screen.

Alternatively, I do not mind having http:// for internal users and https://for external users if its going to be easier.

How can I do this?

Answer 1

If you extend a WebApplication you have to have some difference in the url (could be http vs https) otherwise SharePoint has no way of knowing which zone you're in.

But if you're using SharePoint 2010 then you don't need to extend to get the behaviour you want.

If you enable both Windows and FBA in your zone the default Login Page provides a LogonSelector which allows you to pick the AuthenticationProvider to use. But you can replace this page with your own page which picks the AuthenticationProvider based on the IP address of the request.

For how to create a custom login page see: Creating a Custom Login Page for SharePoint 2010

The code in the out of the box LogonSelector can be a good starting point for your implementation. You can get that by opening C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.IdentityModel\14.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.IdentityModel.dll in ILSpy, Reflector or whatever your favorite SharePoint documentation tool is.

Answer 2

You have to extend your web application to another IIS website, which would give you the ability to serve the same content using different zones and authentication.

Central Administration -> Manage web applications -> Hightlight web application you want to use -> Extend

Answer 3

Thanks Per. I configured it to use http internally and https externally and it works out just fine for us. We dont need a SSL certificate for our internal users in any case.