Hot answers tagged

28

NTLM does only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user ...


24

Two HTTP 401 responses is normal when using NTLM authn, that's the way HTTP works. First it tries an anonymous request which generates the first 401 request. The reponse includes a header that says "try with NTLM". Then the NTLM procedure (which is a challenge/response method) requires one 401 and finally a 200. If you want more details here's a good link: ...


17

One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos. NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol. The big difference is how the two protocols handle the authentication: NTLM uses a three-way handshake between the client and server and ...


15

For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back ...


9

Your choices of autentication are Classic/NTLM, Classic/Kerberos, Claims/NTLM and Claims/Kerberos. Basically your questions are: Classic or Claims, and NTLM or Kerberos. Both questions cover somewhat different concepts and have different implications, although related. There are vast amounts of documentation on both. Here's a short primer on all of this ...


5

A computer in domain2 will not participate in Kerberos in domain1 if there is no trust relation configured between both domains. The fallback is NTLM. To see if kerberos is used you can check with KLIST from a command line (in windows 7 for all other OS user kerbtray from the Windows Resource Kits Tools). Getting a Word document from SharePoint will never ...


5

Here's an example of when you need it and when you don't User >> SharePoint web page with SSRS report viewer via iFrame. NTLM lets user onto the page. User goes direct to SSRS via the iFrame and uses NTLM to authenticate there. Kerberos not required. User >> SharePoint web page with SSRS report viewer in Integrated Mode. User goes to SharePoint and ...


5

Wictor's answer is an excellent one, but for me the root cause of this issue was IIS' mime-type settings. IE and Firefox will completely adhere to the mime-type sent by the server (the default one being application/octet-stream for IIS) but also will not play a video if the mime-type isn't correct - video/webm, video/ogg or video/mp4. By contrast Google ...


5

Why are you deploying your Custom Web Service to the layouts folder at first place? You need to copy the Web service files to the _vti_bin virtual directory Copy the Service1wsdl.aspx file, the Service1disco.aspx file, and the Service1.asmx file to the _vti_bin virtual directory. This is the directory where all default Web services are stored. Copy the ...


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


4

I can't comment on user1272352's answer (rep too low), but that is correct. I had the same problem when creating my custom login page, and the answer was to add the "/_layouts" to the front of the path I was linking to. If you want some form of shared login screen, without needing the IP address or a feature or anything else, here's what I did to get that: ...


3

You cannot use Kerberos for an Internet-facing system (as users cannot receive a ticket from the KDC), however you should use Kerberos for Intranet-facing systems when possible as it is faster as well as more secure.


3

@James Love got this on the head, you need to take a look at the cookies Check out this project "Remote authentication with claims" I believe the answer is here in the code. It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.


3

Everything here is correct thus far, but generally which one to use? When I'm setting up SharePoint, Single-Server setups are typically NTLM, Multi-Server setups are typically Kerberos. Usually Multi-Server setups one day will involve third party tools, etc. that wish to setup authentication integrated somewhat with SharePoint and being cognizant of that, ...


2

Using NTLM over the Internet isn't desirable due to the potential of proxy servers not being able to handle NTLM authentication, but unless you're communicating with NTLMv1, generally you should be fine. If you're doing it over SSL, then you should absolutely be fine with NTLM. NTLM is less secure than Kerberos, however.


2

With SharePoint 2013 the same code will work with bit modification. As SP2013 supports code written in SP2010 as well, and it has both 14 hive and 15 hive, you need show in your code which mapped folders to look for. In your aspx file you need to write the full path of the mapped folders as shown below /_layouts/15/images/ or /_layouts/15/ Rest of all ...


2

Robert Lindgren should get credit for answering this questions because he is correct. ADFS is set at the web app level and can't be targeted at a specific site collection (or site) within it. I verified this with a Microsoft support engineer during a support call for a related matter.


2

If users will never be connecting to backend system for intranet (using BCS) then NTLM suitable. Kerberos solves double hop issue, so Kerberos usually necessary if passing credentials if not using Secure Store Services. There is no ONE solution here. Honestly, your environment and needs for data integration will hold your answer.


1

Steve, What you probably want to do is extend both of your web apps to another zone (such as Internet) and disable NTLM authentication from that zone. That should prevent users from confusing users in the People Picker since only ADFS Auth will be enabled (and thus resolve through the people picker). However, leave NTLM activated on the default zone for ...


1

Well, Eventually got through this by, configuring IE settings. Go To Internet options and add the apps site to trusted sites and then uncheck the tick box "Enable Integrated Authentication" in Advanced tab. This will prompt for Username and password for every new session of user, which is a bit annoying though, and then allows user to log in to the SP app. ...


1

Use claims based authentication for web application and have your client send SAML tokens . The client(Identity Provider) can send you (email,role claims) and Sharepoint (Service Provider) can trust them .After establishing the trust , add the users to sharepoint group so the user can access your site. By using SAML the SSO requirement is also satisfied.


1

There seems to be some confusion because Forms-based Authentication IS claims-based authentication too. As a matter of fact, the default authentication method for SharePoint 2013 is claims-based authentication, which include 3 forms of authentication: Windows, FBA and Trusted Providers (i.e. SAML tokens) Also, SharePoint has NEVER been responsible for ...


1

Credit (much of this was derived from http://cecildt.blogspot.com/2010/10/upload-documents-to-sharepoint-2010.html - thanks Cecil!) SharePoint Steps In SharePoint, create a new document library with a metadata field - call the metadata field "CustomMetaData1". See implementation in method UploadFile below... Visual Studio Create console app in ...


1

There are many variations you can take with this - and really you need to consider more than just your content. For true separation: I would have a dedicated DC to manage service accounts. I would break up my DMZ behind firewall contexts with a reverse proxy publishing SharePoint at the edge. proxy/firewall -- SP Server -- Firewall -- SQL/DC For true ...


1

Try this in powershell: $sts = Get-SPSecurityTokenServiceConfig $sts.WindowsTokenLifetime= (New-Timespan -Minutes 30) $sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 30) $sts.update() IISReset


1

From the server side, you cannot assure a user session is killed impermanently, when using NTLM or(kerberos). While you can kill cookies and the user's current session, from the web app perspective, the user's OS and web browser work against you. Depending on the browser and OS config, they users' passwords will be cached and automatically re-submitted as ...


1

By default, SharePoint Server supports these authentication methods: Anonymous AuthN Basic AuthN NTLM AuthN Digest AuthN Kerberos Protocol Transitioning/Constrained Delegation Windows-Claims Claims MultiAuth Claims Mixed Mode. The CMIS Producer is available by default in SharePoint Server for on-premises deployment Consider you create one app and it ...


1

Can you try out claims/kerberos? Neither classic/ntlm nor claims/ntlm supports delegation. Potentially this is causing the access denied. Also check out this post: Is Classic/NTLM based authentication a security riskfor Internet facing sites?


1

I answered a similar question recently. SharePoint 2010 you should use the Secure Store Service (SSS) for these kind of settings (credentials, connectionstrings etc). That provides a user interface for selected users, you can then in your Web Part Property point to the SSS application ID that you want it to use (you could also get fancy and make the ...


1

From what I've learned from working with FBA and the people picker, FBA has to be enabled on that zone in order for the people picker to pull FBA users. You can enable FBA and use a custom login page for the Intranet zone to only authenticate via NTLM (even though FBA is enabled). I had a post about this recently: NTLM Authenticated Application, FBA, and ...



Only top voted, non community-wiki answers of a minimum length are eligible