Hot answers tagged web-application-zones
5
Firstly, presuming you're using Windows Integrated Authentication for internal access and Forms Based Authentication for the extended extranet zone...
The list item (or the list, or in fact the site that the list is on) can be assigned unique permissions, and you can then simply assign permissions to a group that contains the user's regular Active Directory ...
4
If you extend a WebApplication you have to have some difference in the url (could be http vs https) otherwise SharePoint has no way of knowing which zone you're in.
But if you're using SharePoint 2010 then you don't need to extend to get the behaviour you want.
If you enable both Windows and FBA in your zone the default Login Page provides a LogonSelector ...
4
IMHO - I reproduced the issue you are having on one of our systems except for the use of Claims authentication. My search account does have 'Read' access for the web application. A list was created and anonymous access was initially enabled from inheritance. The search index was already built (it is scheduled to run often) and could query the list as ...
2
Elaborating on JohnnyT's suggestion: Using fiddler (www.fidder2.com) is a great help in detecting if a page load contains request to items that are not published or are not available. Note that it may also simply be a page referenced from another site, eg. A users My site, that the browser by default cannot reuse authentication from. This can be solved my ...
2
My typical experience with this is it's an account delegation problem. Are you running Kerberos? Check if SPN's are correctly configured and if the application accounts have the proper configurations. This especially applies if she's not the only non-admin user having issues.
Next possibility is Browser related, check security zones, cookies, etc...
...
2
It's not a short or simple article but I think it applies to your issue:
Trim SharePoint Search Results for Better Security
Microsoft SharePoint search uses an account that usually has full read
access across the repository to index its contents. So it’s important
that when a user queries for some content, he should be restricted to
view only the ...
2
As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...
2
The easiest way to think of it is this:
An extended web application is merley an additional IIS web site pointing to the same content. This web site will have a new folder under inetpub\wss\virtualdirectories with the default files within (including web.config)
This means that the extended web application will share the majority of settings with the ...
2
hmm it shouldnt be necessary to extend the web app. Normally you can define what you want by adding a new AAM. Extending zones is usually if you need seperate security context (extranet) or specific authentication (eg for indexing).
What exactly isnt working with the correct urls?
I can recommend the following ressources on AAM:
...
1
var webService = SPFarm.Local.Services.OfType<SPWebService>().FirstOrDefault();
if (webService != null)
{
var webApp = webService.WebApplications.FirstOrDefault(wa => wa.GetResponseUri(SPUrlZone.Default).Port == 80);
if (webApp != null)
{
Uri webAppUri = new Uri(webApp.GetResponseUri(SPUrlZone.Default).AbsoluteUri);
1
Zones are just markers. You can easily remove them from via CA under AAM (Alternate Access Mappings, just clear out everything but what resides in the default zone. You could just as easily leave everything as is and just allow access to the default zone.
You can do this via deletezoneurl in STSADM ( ...
1
[Updated]
It can be a loopback check that is being done to prevent reflection attacks against your system. The theory is that if a request comes from your machine to a DNS name that doesn’t match the machine name, the check will block the authentication.
Try this:
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and ...
1
Certificates can only be applied at the WebApp level in IIS, and you can only assign one certificate per application.
Unless you are using a reverse proxy that will change the URL's you will need a cert that covers each URL you will be accessing with SSL enabled.
Because your URL's utilize different domain names, you can not take advantage of a wildcard ...
1
You dont actually says if you want AD users to be able to login remotely, so ill assume not (because its kind of a security risk if you dont set it up right)
You should probably have a split DNS, so that your public DNS only has the internet url and the internal DNS only has the internal url. This way external users will never see the intranet url, and vica ...
1
The purpose of extending a Web application is to have separate IIS Web sites to expose content to different sets of users so yes - unextending your Web app and selecting the delete option should remove the IIS site and requests to the "extended" site URL will cease to work.
In answer to your second question, you should note that adding a host header to the ...
Only top voted, non community-wiki answers of a minimum length are eligible
