1

One of my customer has a requirement which is to allow basic authentication because a outdated SSO and reverse proxy tool (changing this is not an option today). This is true for external access (both employees and partners), internal access is direct to the server, then it can use Kerberos.

Because Basic authentication can be a major security hole, I'd like to have in my SP farm two "endpoints" :

  • one for internal access, that accepts only Kerberos
  • one for external access, that accepts only basic. I want to allow only the reverse proxy server to access this endpoint.

What is the best way to achieve this ?

Because the basic authentication relies on HTTP headers, I can't use a firewall rule. As my application url will be the same for both internal and external access (http://myapp.mycompany.com), I can't use sharepoint zone to defines these two endpoints. As a best practice, I don't want to set up listening IP addresses directly in IIS...

thanks in advance for any advice.

Improve this question

1 Answer 1

Reset to default
0

Create a web application for internal, set it up with Kerberos, then extend the web application, and set up the extended web application with Basic auth. You'll end up with two URLs like this (or whatever you want them to be):

http://external.mycompany.com
http://internal.mycompany.com

They will both point to the same content database. So if you create a site on external called /siteone, then /siteone will also exist on internal, as they are both pointing to the same content database.

Each of them can be set up with completely different authentication scenarios - you can use Basic Auth on one and Kerberos on the other, as you want - they could even point to completely different user stores if you want. Then you can go into IIS and set a rule for the external site so that external can only be accessed from your reverse proxy server.

More information on Extending a Web Application:

http://technet.microsoft.com/en-us/library/cc261698.aspx

http://sharepointresourcecenter.com/docid1256.html

Improve this answer
4
  • I can't use two urls, as I said in my first post. The customer scenario is to allow their employee to be able to connect to the application from any place (using the custom sso and reverse proxy). If I use two urls, users will face two applications (regarding email alerts, etc.). That's why I posted my question... because the well documented scenario can't apply in my case.
    – Steve B
    Commented Mar 21, 2011 at 14:18
  • If the same users will be accessing the site both internally and externally, and if you want to have both external and internal access behaving in the same manner in regards to incoming links from email alerts, why not just set up one web application, using a single authentication scheme? (choosing either Kerberos or your SSO setup)
    – CodeThug
    Commented Mar 21, 2011 at 14:41
  • sorry for the delay, I didn't get the notification of the answer ...
    – Steve B
    Commented Jun 29, 2011 at 8:36
  • these authentication scheme is a requirement from the customer. However, getting new info from him : the sso can simulate kerberors authentication. So, from the SP perspective, it's transparent. thx for the help
    – Steve B
    Commented Jun 29, 2011 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.