Tag Info

Hot answers tagged

21

NTLM is only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user context ...


18

Two HTTP 401 responses is normal when using NTLM authn, that's the way HTTP works. First it tries an anonymous request which generates the first 401 request. The reponse includes a header that says "try with NTLM". Then the NTLM procedure (which is a challenge/response method) requires one 401 and finally a 200. If you want more details here's a good link: ...


14

One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos. NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol. The big difference is how the two protocols handle the authentication: NTLM uses a three-way handshake between the client and server and ...


12

For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back ...


8

Your choices of autentication are Classic/NTLM, Classic/Kerberos, Claims/NTLM and Claims/Kerberos. Basically your questions are: Classic or Claims, and NTLM or Kerberos. Both questions cover somewhat different concepts and have different implications, although related. There are vast amounts of documentation on both. Here's a short primer on all of this ...


5

Wictor's answer is an excellent one, but for me the root cause of this issue was IIS' mime-type settings. IE and Firefox will completely adhere to the mime-type sent by the server (the default one being application/octet-stream for IIS) but also will not play a video if the mime-type isn't correct - video/webm, video/ogg or video/mp4. By contrast Google ...


5

A computer in domain2 will not participate in Kerberos in domain1 if there is no trust relation configured between both domains. The fallback is NTLM. To see if kerberos is used you can check with KLIST from a command line (in windows 7 for all other OS user kerbtray from the Windows Resource Kits Tools). Getting a Word document from SharePoint will never ...


5

Why are you deploying your Custom Web Service to the layouts folder at first place? You need to copy the Web service files to the _vti_bin virtual directory Copy the Service1wsdl.aspx file, the Service1disco.aspx file, and the Service1.asmx file to the _vti_bin virtual directory. This is the directory where all default Web services are stored. Copy the ...


4

Here's an example of when you need it and when you don't User >> SharePoint web page with SSRS report viewer via iFrame. NTLM lets user onto the page. User goes direct to SSRS via the iFrame and uses NTLM to authenticate there. Kerberos not required. User >> SharePoint web page with SSRS report viewer in Integrated Mode. User goes to SharePoint and ...


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


3

You cannot use Kerberos for an Internet-facing system (as users cannot receive a ticket from the KDC), however you should use Kerberos for Intranet-facing systems when possible as it is faster as well as more secure.


3

@James Love got this on the head, you need to take a look at the cookies Check out this project "Remote authentication with claims" I believe the answer is here in the code. It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.


3

I can't comment on user1272352's answer (rep too low), but that is correct. I had the same problem when creating my custom login page, and the answer was to add the "/_layouts" to the front of the path I was linking to. If you want some form of shared login screen, without needing the IP address or a feature or anything else, here's what I did to get that: ...


2

Everything here is correct thus far, but generally which one to use? When I'm setting up SharePoint, Single-Server setups are typically NTLM, Multi-Server setups are typically Kerberos. Usually Multi-Server setups one day will involve third party tools, etc. that wish to setup authentication integrated somewhat with SharePoint and being cognizant of that, ...


2

Using NTLM over the Internet isn't desirable due to the potential of proxy servers not being able to handle NTLM authentication, but unless you're communicating with NTLMv1, generally you should be fine. If you're doing it over SSL, then you should absolutely be fine with NTLM. NTLM is less secure than Kerberos, however.


2

With SharePoint 2013 the same code will work with bit modification. As SP2013 supports code written in SP2010 as well, and it has both 14 hive and 15 hive, you need show in your code which mapped folders to look for. In your aspx file you need to write the full path of the mapped folders as shown below /_layouts/15/images/ or /_layouts/15/ Rest of all ...


2

If users will never be connecting to backend system for intranet (using BCS) then NTLM suitable. Kerberos solves double hop issue, so Kerberos usually necessary if passing credentials if not using Secure Store Services. There is no ONE solution here. Honestly, your environment and needs for data integration will hold your answer.


1

Use claims based authentication for web application and have your client send SAML tokens . The client(Identity Provider) can send you (email,role claims) and Sharepoint (Service Provider) can trust them .After establishing the trust , add the users to sharepoint group so the user can access your site. By using SAML the SSO requirement is also satisfied.


1

Well, Eventually got through this by, configuring IE settings. Go To Internet options and add the apps site to trusted sites and then uncheck the tick box "Enable Integrated Authentication" in Advanced tab. This will prompt for Username and password for every new session of user, which is a bit annoying though, and then allows user to log in to the SP app. ...


1

Can you try out claims/kerberos? Neither classic/ntlm nor claims/ntlm supports delegation. Potentially this is causing the access denied. Also check out this post: Is Classic/NTLM based authentication a security riskfor Internet facing sites?


1

From the server side, you cannot assure a user session is killed impermanently, when using NTLM or(kerberos). While you can kill cookies and the user's current session, from the web app perspective, the user's OS and web browser work against you. Depending on the browser and OS config, they users' passwords will be cached and automatically re-submitted as ...


1

Try this in powershell: $sts = Get-SPSecurityTokenServiceConfig $sts.WindowsTokenLifetime= (New-Timespan -Minutes 30) $sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 30) $sts.update() IISReset


1

You may also notice that on the "real" FBA zone, if Windows Authentication is disabled, the People Picker won't show AD users either. So you're correct that in order to pick users from the underlying repository, authentication for that repository must be enabled. You can try using http://spautomaticsignin.codeplex.com/ if you want to automatically sign in ...


1

From what I've learned from working with FBA and the people picker, FBA has to be enabled on that zone in order for the people picker to pull FBA users. You can enable FBA and use a custom login page for the Intranet zone to only authenticate via NTLM (even though FBA is enabled). I had a post about this recently: NTLM Authenticated Application, FBA, and ...


1

I answered a similar question recently. SharePoint 2010 you should use the Secure Store Service (SSS) for these kind of settings (credentials, connectionstrings etc). That provides a user interface for selected users, you can then in your Web Part Property point to the SSS application ID that you want it to use (you could also get fancy and make the ...


1

Kerberos is definitely tricky to get right. I would recommend following the instructions in the following document exactly and in detail. Any small detail can break it and troubleshooting is painful. http://go.microsoft.com/fwlink/p/?LinkId=196600 Regarding multiple domains, here is what it has to say: The scenarios in this set of articles about ...



Only top voted, non community-wiki answers of a minimum length are eligible