Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

NTLM or Kerberos.... which authentication is suitable for

  1. Intranet application?

  2. Internet application?

Will answer differ if 3rd party tools are used?

for MySite and ContentType Hub application which authentication should we follow?

if any web application has Form Based authentication NTLM or Kerberos which one will be correct approach?

share|improve this question
add comment

2 Answers 2

You cannot use Kerberos for an Internet-facing system (as users cannot receive a ticket from the KDC), however you should use Kerberos for Intranet-facing systems when possible as it is faster as well as more secure.

share|improve this answer
    
for MySite and ContentType Hub which authentication should we follow? if any web application has Form Based authentication NTLM or Kerberos which one will be correct approach? –  Mdh22 Jun 23 '13 at 15:09
1  
MySites and ContentType Hubs are just site collections and follow the protocol in place for the webapplication. With FBA you can't use Kerberos unless you have a third party (UAG, NetScaler, BigIP, etc) that can delegate credentials. –  Jesus Shelby Jun 23 '13 at 19:10
add comment

If users will never be connecting to backend system for intranet (using BCS) then NTLM suitable. Kerberos solves double hop issue, so Kerberos usually necessary if passing credentials if not using Secure Store Services.

There is no ONE solution here. Honestly, your environment and needs for data integration will hold your answer.

share|improve this answer
    
if Secure Store Services is used for BCS then NTLM is OK for intranet? Trevor seward said different. –  Mdh22 Jun 23 '13 at 15:13
1  
Kerberos is not required for Secure Store Services in intranet environment. In fact, Secure Store Services is one of the double-hop solutions in a NTLM environment. And when Secure Store Services can be used I am, typically, in favor. Trevor is exactly correct, however, in saying that Secure Store Services cannot be used in internet-facing environment because users cannot authenticate to AD. I am not sure about anonymous authentication with Secure Store as I have never tested. But I would generally say stay away from anonymous access to your secured data anyway. –  JuanTrev Jun 24 '13 at 12:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.