Tag Info

Hot answers tagged

5

Firstly, presuming you're using Windows Integrated Authentication for internal access and Forms Based Authentication for the extended extranet zone... The list item (or the list, or in fact the site that the list is on) can be assigned unique permissions, and you can then simply assign permissions to a group that contains the user's regular Active Directory ...


4

As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...


4

If you extend a WebApplication you have to have some difference in the url (could be http vs https) otherwise SharePoint has no way of knowing which zone you're in. But if you're using SharePoint 2010 then you don't need to extend to get the behaviour you want. If you enable both Windows and FBA in your zone the default Login Page provides a LogonSelector ...


4

IMHO - I reproduced the issue you are having on one of our systems except for the use of Claims authentication. My search account does have 'Read' access for the web application. A list was created and anonymous access was initially enabled from inheritance. The search index was already built (it is scheduled to run often) and could query the list as ...


2

The easiest way to think of it is this: An extended web application is merley an additional IIS web site pointing to the same content. This web site will have a new folder under inetpub\wss\virtualdirectories with the default files within (including web.config) This means that the extended web application will share the majority of settings with the ...


2

hmm it shouldnt be necessary to extend the web app. Normally you can define what you want by adding a new AAM. Extending zones is usually if you need seperate security context (extranet) or specific authentication (eg for indexing). What exactly isnt working with the correct urls? I can recommend the following ressources on AAM: ...


2

See the following answered question for more info on this. Whats the difference between host headers and alternate access mappings? SPDoctor has a very good explanation on the difference between the 2 methods for managing IIS and host headers for your SharePoint server. It is always best to let SharePoint handling IIS by extending the web application ...


2

Elaborating on JohnnyT's suggestion: Using fiddler (www.fidder2.com) is a great help in detecting if a page load contains request to items that are not published or are not available. Note that it may also simply be a page referenced from another site, eg. A users My site, that the browser by default cannot reuse authentication from. This can be solved my ...


2

My typical experience with this is it's an account delegation problem. Are you running Kerberos? Check if SPN's are correctly configured and if the application accounts have the proper configurations. This especially applies if she's not the only non-admin user having issues. Next possibility is Browser related, check security zones, cookies, etc... ...


2

It's not a short or simple article but I think it applies to your issue: Trim SharePoint Search Results for Better Security Microsoft SharePoint search uses an account that usually has full read access across the repository to index its contents. So it’s important that when a user queries for some content, he should be restricted to view only the ...


2

var webService = SPFarm.Local.Services.OfType<SPWebService>().FirstOrDefault(); if (webService != null) { var webApp = webService.WebApplications.FirstOrDefault(wa => wa.GetResponseUri(SPUrlZone.Default).Port == 80); if (webApp != null) { Uri webAppUri = new Uri(webApp.GetResponseUri(SPUrlZone.Default).AbsoluteUri);


2

When you extend a SharePoint web application, you are telling SharePoint to go to IIS and create a new site, but SharePoint will use it to show the same content. You would normally do that to support different security, authentication and URLs between an Internet site, Intranet and Extranet, for example. When you add a host header it is equivalent to going ...


2

SharePoint uses the default URL for links in alerts and workflows that are automatically kicked off. Regarding alerts the only real way around this is to change the URL of the Default zone. This can be done in CA with the AAM, by the cmdlet Set-SPAlternateURL or (my preference) delete the web application (preserving the data of course) and creating a new ...


1

These zones, and their labels, are just labels. There is no functional difference between the five. However, these labels indicate to the next administrator how they are used, and what they are for. You may not need more than one zone to use different authentication methods. In fact, Microsoft "recommend that you implement multiple authentication methods on ...


1

Zones are just markers. You can easily remove them from via CA under AAM (Alternate Access Mappings, just clear out everything but what resides in the default zone. You could just as easily leave everything as is and just allow access to the default zone. You can do this via deletezoneurl in STSADM ( ...


1

[Updated] It can be a loopback check that is being done to prevent reflection attacks against your system. The theory is that if a request comes from your machine to a DNS name that doesn’t match the machine name, the check will block the authentication. Try this: Click Start, click Run, type regedit, and then click OK. In Registry Editor, locate and ...


1

Certificates can only be applied at the WebApp level in IIS, and you can only assign one certificate per application. Unless you are using a reverse proxy that will change the URL's you will need a cert that covers each URL you will be accessing with SSL enabled. Because your URL's utilize different domain names, you can not take advantage of a wildcard ...


1

You dont actually says if you want AD users to be able to login remotely, so ill assume not (because its kind of a security risk if you dont set it up right) You should probably have a split DNS, so that your public DNS only has the internet url and the internal DNS only has the internal url. This way external users will never see the intranet url, and vica ...


1

The purpose of extending a Web application is to have separate IIS Web sites to expose content to different sets of users so yes - unextending your Web app and selecting the delete option should remove the IIS site and requests to the "extended" site URL will cease to work. In answer to your second question, you should note that adding a host header to the ...



Only top voted, non community-wiki answers of a minimum length are eligible