Tag Info

Hot answers tagged

21

NTLM is only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user context ...


18

Two HTTP 401 responses is normal when using NTLM authn, that's the way HTTP works. First it tries an anonymous request which generates the first 401 request. The reponse includes a header that says "try with NTLM". Then the NTLM procedure (which is a challenge/response method) requires one 401 and finally a 200. If you want more details here's a good link: ...


14

One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos. NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol. The big difference is how the two protocols handle the authentication: NTLM uses a three-way handshake between the client and server and ...


12

For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back ...


9

Ok, there are APIs to support everything you're tyring to do, NEVER DIRECTLY EDIT THE web.config!!!!!!! Follow these easy steps: Package your custom error pages into a solution. Hey, if you're doing the 401 you might want to add a couple of others to support access requests too ;) Deploy the pages to {SP_Root}\Tempates\Layouts\MyErrorPages\ using a ...


8

I thinnk I found the solution. In app.config set security mode to TransportCredentialOnly and transport clientCredentialType to Ntlm. See snippet below. <?xml version="1.0" encoding="utf-8" ?> <configuration> <system.serviceModel> <bindings> <basicHttpBinding> <binding name="ListsSoap" ...


7

Authentication.asmx is the correct way of logging into SharePoint directly as you said. However occasionally you'll need to create your own Authentication ticket if you're working outside of SharePoint and need to pass something in via Kerberos. This here is a good reference on the authentication.asmx webservice as it concerns .NET ...


6

In my experience its 99% a resource that the user can’t access, it might be an image, a .css file or anything else. When she logs from inside the network, is everything working as it should?


6

You could also use the Microsoft Threat Management Gateway 2010 (TMG 2010) to publish your SharePoint intranet in a secure way. It could for instance be published on a Web address like https://intranet.yourcompany.com Now, my suggestion does of course require that you are using the TMG as a firewall between the internet and your internal network. But I can ...


6

You need to configure the farm to trust LiveID. Technet has documentation on configuring claims for LiveID http://technet.microsoft.com/en-us/library/ff973117.aspx Edit I have not implemented this myself, so I'm speaking just from knowledge of how I perceive it to work. I don't think you need to edit the _trust/default.aspx page, but implement a custom ...


6

A couple of things to check for First of all - you do not need delegation yet. Wait with that until you get the log on process to work make sure that the DNS name sharepoint is registered with an A record in DNS (and not a CNAME) register SPN's for both HTTP/sharepoint and HTTP/sharepoint.bkf.internal make sure that the account you use when setting the SPN ...


6

In IE (version > 6) SignOut.aspx uses ClearAuthenticationCache as a client side command. This does not work for Firefox. I found this example on StackOverflow that might work for you http://stackoverflow.com/questions/31326/is-there-a-browser-equivalent-to-ies-clearauthenticationcache


5

Kerberos is required if you are going to use certain features like SQL Server Reporting Services, Outlook Web Access, Performance Point, etc where the user's request to SharePoint has to be be forwarded to a subsequent system; a process known as "the double hop". If the system is set for Kerberos it will fall back to NTLM if Kerberos cannot be used. To ...


5

Check, or double check, if the loopback check is disabled Check if you can log in from your client pc instead of logging in from the server Disable "enhanced security" of the IE on the server (for test purposes only) and try it again Add SharePoint site to the intranet zone in IE Log in with "the other user" and check the permissions of your account (like ...


5

SharePoint web services respect security. Most likely, this is simply a configuration issue. According to this article, there are two main ways anonymous users can be granted access: Web level List/library level It sounds like currently the site is configured at the web level for anonymous access. I would look into disabling that and instead enabling it ...


5

Being that you are not seeing the users, I'm going to assume its an external domain. You have a few options available to you. TRUSTS The easiest from SP perspective is to utilize trusts. This requires the Domain Admins from both domains to configure either a two way or one way trust. http://technet.microsoft.com/en-us/library/cc757352(WS.10).aspx Then ...


5

Wictor's answer is an excellent one, but for me the root cause of this issue was IIS' mime-type settings. IE and Firefox will completely adhere to the mime-type sent by the server (the default one being application/octet-stream for IIS) but also will not play a video if the mime-type isn't correct - video/webm, video/ogg or video/mp4. By contrast Google ...


5

As Kjetil says you need to fix up your SPN's. This is one of the most common errors when setting up Kerberos - not having control of where your SPN's ends up and not having it thorougly documented. Do like this to proceed: Remove the SPN using setspn -D from the account that is NOT the application pool of your web application Restart IIS (or reboot) your ...


5

As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...


5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

Expanding on what others have written above, in SharePoint 2010 and 2013 it depends on the type of authentication you've setup your Web Application with. For classic mode you only have windows authentication so NT AUTHORITY\authenticated users will grant access to anyone that can authenticate with a valid windows credential. For claims mode you'll have at ...


5

The domain that needs to be isolated is only a DNS domain not a new AD domain. This is purely such that you have a separate IIS site where Cross Site Scripting is prevented by the browser. You can add that new domain in DNS (see Configure an environment for apps for SharePoint (SharePoint 2013)) or hosts file. The High trust app still needs the same ...


5

Instead of a network credential, you will need a SharePoint Online Credential: http://msdn.microsoft.com/en-us/library/office/microsoft.sharepoint.client.sharepointonlinecredentials_members(v=office.15).aspx


4

Here is an article I wrote a while back to pull together resources for supporting multiple domains. http://www.mikeoryszak.com/sharepoint/supporting-multiple-active-directory-domains


4

Here's an example of when you need it and when you don't User >> SharePoint web page with SSRS report viewer via iFrame. NTLM lets user onto the page. User goes direct to SSRS via the iFrame and uses NTLM to authenticate there. Kerberos not required. User >> SharePoint web page with SSRS report viewer in Integrated Mode. User goes to SharePoint and ...


4

I can add "X-FORMS_BASED_AUTH_ACCEPTED" in the request header with a value of "f" and then I get the NTLM challenge that I want. This works in both Firefox REST client and when I updated the Java code (the code that makes the request) everything works :-). I found this little tidbit at ...


4

Configure the Token Cache to a smaller value: http://technet.microsoft.com/en-us/library/cc287917(office.12).aspx. Default is 1440 minutes (24hrs)


4

To use the Outlook Web Access web parts such as MyInbox, MyTasks and MyCalendar requires authentication to the data inside of Exchange. If you want it to work automatically, then you need to have the SharePoint web application setup with Kerberos. This allows the user's credential passed to SharePoint to be forwarded (delegated) to another system. This ...


4

Not sure I would use PowerShell for this. Why not use Business Connectivity Service (SP2010) or Business Data Catalog (SP2007) for this? If you need to move data redundantly into a list in SharePoint with certain intervals another option would be SQL Integration Services.


4

EDIT I have now tried this from within a console application local to my SharePoint VM. I can confirm it works in that environment (both "Created By" and "Modified By" were updated). Let us know if you run into issues using it from within your Windows Service. If I understand your requirement correctly you could most likely update the list item after the ...



Only top voted, non community-wiki answers of a minimum length are eligible