Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Can some please tell me how to grant external users access to sharepoint external facing site? I have a sharepoint 2013 enterprise standalone server.

share|improve this question
    
How are "internal" users accessing the site now? Do you have an external authentication source you control? or would you rather use other authentication sources (Microsoft ID, Facebook, OpenID types of things?) –  lwbecker2 Dec 6 '12 at 20:14
    
internal users are authenticating through AD once they are given access to the site. I would rather not give external users AD accounts and we currently do not have an external authentication source. Can you please give me some suggestion of good ones. Also, is there away to do it with out an external authentication source? Can sharepoint do the authentication if the site can be viewed externally? –  Kevin Dec 6 '12 at 20:23
    
you could have a separate AD that you then make a one way trust ? –  Oddmar Dam Dec 6 '12 at 21:10
    
Ok if the site is already externally can I just create local users on the SharePoint Server and have them authenticate that way. If so is there any security risk in doing that way? –  Kevin Dec 7 '12 at 15:52
add comment

1 Answer

For external access I would suggest using identity provider with SAML authentication.

SAML token-based authentication

SAML token-based authentication in SharePoint 2013 uses the SAML 1.1 protocol and the WS-Federation Passive Requestor Profile (WS-F PRP). It requires coordination with administrators of a claims-based environment, whether it is your own internal environment or a partner environment. If you use Active Directory Federation Services (AD FS) 2.0, you have a SAML token-based authentication environment.

A SAML token-based authentication environment includes an identity provider security token service (IP-STS). The IP-STS issues SAML tokens on behalf of users whose accounts are included in the associated authentication provider. Tokens can include any number of claims about a user, such as a user name and the groups to which the user belongs. An AD FS 2.0 server is an example of an IP-STS.

SharePoint 2013 takes advantage of claims that are included in tokens that an IP-STS issues to authorized users. In claims environments, an application that accepts SAML tokens is known as a relying party STS (RP-STS). A relying party application receives the SAML token and uses the claims inside to decide whether to grant the client access to the requested resource. In SharePoint 2013, each web application that is configured to use a SAML provider is added to the IP-STS server as a separate RP-STS entry. A SharePoint farm can represent multiple RP-STS entries in the IP-STS.

enter image description here

Reference: Plan for SAML token-based authentication

More to read: Design Sample: Extranet with Dedicated Zones for Authentication for SharePoint 2013

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.