SharePoint 2013 authentification with Kerberos and Forms

Question

We are currently using SP2010 with ADFS to implement the following scenario:

[Internet]->ADFS with Webform->[SP2010]<-ADFS with Windows Auth<-[Internal Network] SharePoint has only one Url (https://sp2010.publicdomain.com) for both, Internet and Intranet access.

For the migration to SP2013 we would like to get rid off ADFS and use Windows Auth (Kerberos) instead. The issue now: For internet access, there will be no form, but just the default browser credential dialog. However, for internal access this is correct (auto logon within intranet zone, so no login prompt for internal users)

We looked into using a reverse proxy to have a forms based logon for external access, but UAG/TMG is no longer sold and IIS Application Request Routing (which is the new recommendation from Microsoft for reverse proxies) does not support this "forms" scenario.

Important: We cannot extend the SharePoint WebApp and use two different Urls for intern/extern.

Any idea how to solve this? One more thing: We definitely don't want forms based auth only, because internal users must not see a logon prompt.

Thank you very much. If anything is not clear, please add a comment.

Answer 1

Old Question - but I'll put the answer here for reference

The Microsoft recommendation is to use the Web Application Proxy role (which still requires ADFS). Internal users will can by pointed to SharePoint directly and external users would come in thru the proxy (which will be configured for FBA).

Web Application Role is supported on Windows 2012 R2 and you would deploy ADFS 3.0 as well in this scenario. You will find plenty of guidance on configuring WAP and ADFS. It's the 2nd part that is important.

enable delegation for the Web Application Proxy computer, you want constrained delegation and the you will point to the SPN that is configured for SharePoint WebApplication(you will point to the service account you set the SPN on).

On ADFS you will create a non-claims aware relying party trust. Add the web app URL as the identifier

Add claim rule Permit all users

Configure WAP Publish a new application, use ADFS for pre-auth, and then select your non-claim aware application you published in ADFS. You will have to provide the information for your application (certificate, spn endpoint, etc) and then publish.

Now when you browse the WAP you should be able to logon to SharePoint.