Tag Info

Hot answers tagged

19

NTLM is only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user context ...


18

Two HTTP 401 responses is normal when using NTLM authn, that's the way HTTP works. First it tries an anonymous request which generates the first 401 request. The reponse includes a header that says "try with NTLM". Then the NTLM procedure (which is a challenge/response method) requires one 401 and finally a 200. If you want more details here's a good link: ...


13

One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos. NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol. The big difference is how the two protocols handle the authentication: NTLM uses a three-way handshake between the client and server and ...


11

For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back ...


9

Ok, there are APIs to support everything you're tyring to do, NEVER DIRECTLY EDIT THE web.config!!!!!!! Follow these easy steps: Package your custom error pages into a solution. Hey, if you're doing the 401 you might want to add a couple of others to support access requests too ;) Deploy the pages to {SP_Root}\Tempates\Layouts\MyErrorPages\ using a ...


8

I thinnk I found the solution. In app.config set security mode to TransportCredentialOnly and transport clientCredentialType to Ntlm. See snippet below. <?xml version="1.0" encoding="utf-8" ?> <configuration> <system.serviceModel> <bindings> <basicHttpBinding> <binding name="ListsSoap" ...


7

Authentication.asmx is the correct way of logging into SharePoint directly as you said. However occasionally you'll need to create your own Authentication ticket if you're working outside of SharePoint and need to pass something in via Kerberos. This here is a good reference on the authentication.asmx webservice as it concerns .NET ...


6

You could also use the Microsoft Threat Management Gateway 2010 (TMG 2010) to publish your SharePoint intranet in a secure way. It could for instance be published on a Web address like https://intranet.yourcompany.com Now, my suggestion does of course require that you are using the TMG as a firewall between the internet and your internal network. But I can ...


6

A couple of things to check for First of all - you do not need delegation yet. Wait with that until you get the log on process to work make sure that the DNS name sharepoint is registered with an A record in DNS (and not a CNAME) register SPN's for both HTTP/sharepoint and HTTP/sharepoint.bkf.internal make sure that the account you use when setting the SPN ...


6

In IE (version > 6) SignOut.aspx uses ClearAuthenticationCache as a client side command. This does not work for Firefox. I found this example on StackOverflow that might work for you http://stackoverflow.com/questions/31326/is-there-a-browser-equivalent-to-ies-clearauthenticationcache


5

Kerberos is required if you are going to use certain features like SQL Server Reporting Services, Outlook Web Access, Performance Point, etc where the user's request to SharePoint has to be be forwarded to a subsequent system; a process known as "the double hop". If the system is set for Kerberos it will fall back to NTLM if Kerberos cannot be used. To ...


5

Check, or double check, if the loopback check is disabled Check if you can log in from your client pc instead of logging in from the server Disable "enhanced security" of the IE on the server (for test purposes only) and try it again Add SharePoint site to the intranet zone in IE Log in with "the other user" and check the permissions of your account (like ...


5

SharePoint web services respect security. Most likely, this is simply a configuration issue. According to this article, there are two main ways anonymous users can be granted access: Web level List/library level It sounds like currently the site is configured at the web level for anonymous access. I would look into disabling that and instead enabling it ...


5

Being that you are not seeing the users, I'm going to assume its an external domain. You have a few options available to you. TRUSTS The easiest from SP perspective is to utilize trusts. This requires the Domain Admins from both domains to configure either a two way or one way trust. http://technet.microsoft.com/en-us/library/cc757352(WS.10).aspx Then ...


5

You need to configure the farm to trust LiveID. Technet has documentation on configuring claims for LiveID http://technet.microsoft.com/en-us/library/ff973117.aspx Edit I have not implemented this myself, so I'm speaking just from knowledge of how I perceive it to work. I don't think you need to edit the _trust/default.aspx page, but implement a custom ...


5

As Kjetil says you need to fix up your SPN's. This is one of the most common errors when setting up Kerberos - not having control of where your SPN's ends up and not having it thorougly documented. Do like this to proceed: Remove the SPN using setspn -D from the account that is NOT the application pool of your web application Restart IIS (or reboot) your ...


5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

Expanding on what others have written above, in SharePoint 2010 and 2013 it depends on the type of authentication you've setup your Web Application with. For classic mode you only have windows authentication so NT AUTHORITY\authenticated users will grant access to anyone that can authenticate with a valid windows credential. For claims mode you'll have at ...


5

The domain that needs to be isolated is only a DNS domain not a new AD domain. This is purely such that you have a separate IIS site where Cross Site Scripting is prevented by the browser. You can add that new domain in DNS (see Configure an environment for apps for SharePoint (SharePoint 2013)) or hosts file. The High trust app still needs the same ...


4

Here is an article I wrote a while back to pull together resources for supporting multiple domains. http://www.mikeoryszak.com/sharepoint/supporting-multiple-active-directory-domains


4

I can add "X-FORMS_BASED_AUTH_ACCEPTED" in the request header with a value of "f" and then I get the NTLM challenge that I want. This works in both Firefox REST client and when I updated the Java code (the code that makes the request) everything works :-). I found this little tidbit at ...


4

To use the Outlook Web Access web parts such as MyInbox, MyTasks and MyCalendar requires authentication to the data inside of Exchange. If you want it to work automatically, then you need to have the SharePoint web application setup with Kerberos. This allows the user's credential passed to SharePoint to be forwarded (delegated) to another system. This ...


4

Not sure I would use PowerShell for this. Why not use Business Connectivity Service (SP2010) or Business Data Catalog (SP2007) for this? If you need to move data redundantly into a list in SharePoint with certain intervals another option would be SQL Integration Services.


4

Error 401 is for Unauthorized Access (or Access Denied). In a SharePoint site, "Access Denied" is managed at two levels - IIS and SharePoint. The web.config changes you did are meant for IIS. As "access denied" inside SharePoint site is managed by SharePoint, for IIS there is no 401 and hence no redirection. To set custom 401 page for a SharePoint site, ...


4

If you extend a WebApplication you have to have some difference in the url (could be http vs https) otherwise SharePoint has no way of knowing which zone you're in. But if you're using SharePoint 2010 then you don't need to extend to get the behaviour you want. If you enable both Windows and FBA in your zone the default Login Page provides a LogonSelector ...


4

It all depends on which type of authentication scenarios you have in place. The SignOut.aspx clears those cookies (e.g. Sharepoint-KeepSessionAuthenticated) and abandon's session variables for the current user. I've seen various solutions (e.g. http://social.msdn.microsoft.com/Forums/en/sharepointcustomization/thread/f9021dbf-59e2-4aca-b4fc-3f464b802df9) ...


4

As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...


3

Try disabling the one of these health check rules in central admin: Automatic Update setting inconsistent across farm servers Web.config files are not identical on all machines in the farm http://ctp.social.technet.microsoft.com/Forums/en-NZ/sharepoint2010programming/thread/0d4a9a65-a208-45a7-a082-fc881957cdc0


3

SharePoint will display the "System Account" for the farm administrator. In addition every user that has "Full control" over the web application through a user policy and where the "Account operates as System" checkbox is enabled will be displayed that way. If you want to change the farm account you need to register this new account under "Application ...


3

Ok, my problem got solved. Reading doesn't seem to be one of my strengths. I used the wrong URL. It's not http://<central administration>/_vti_bin/Admin.asmx but http://<central administration>/_vti_adm/Admin.asmx Sorry for bothering you with my question!



Only top voted, non community-wiki answers of a minimum length are eligible