We're planning a sharepoint intranet which will be acceded directly from our LAN, however it should be accesible from the Internet, too. What would be the best authentication method available for this purpose?.

NOTE: A digital certificate will be established for accesing the IIS site to secure communication.

Thank you

  • 1
    Do you want to allow unauthenticated users to access certain sites within your internal web application? Or, will there be external users that need to be authenticated using FBA? Or, are these internal users that just need to access your site when not on the internal network?
    – Laurie
    Jul 6, 2011 at 0:23
  • The idea is not to allow anonymous users to have access to the web application, but rather allow the same internal users to access safely and securely through the Internet. Eventually, could exist some external users (providers, associates etc.) to access in a restricted way to the site. thank you.
    – haroldmoma
    Jul 6, 2011 at 0:29

2 Answers 2


To allow your internal users to access the site from off-site, you should set them up with VPN access to the network.

As far as advice on setting up access for external users, you will need to know more about who they are and what they will need to access before you can make a good decision on that.

If you will be using the same site for internal and external, you can extend your existing web application, provide another url for your external users, use form-based authentication for them to log in, and place those users into SharePoint groups in order to manage permissions.

How to: Expose a SharePoint Application to the Extranet and Use Forms-Based Authentication

However, depending on your use cases, you may decide to create a separate site for your external users and use content deployment to move data appropriate to those users to that site.

  • Thanks for your answer. I think your last idea is sound, therefore I will have to look at content deployment to move forward in that direction.
    – haroldmoma
    Jul 6, 2011 at 1:58

You could also use the Microsoft Threat Management Gateway 2010 (TMG 2010) to publish your SharePoint intranet in a secure way. It could for instance be published on a Web address like https://intranet.yourcompany.com

Now, my suggestion does of course require that you are using the TMG as a firewall between the internet and your internal network. But I can only recommend that - it is a very strong product. For authentication just use Windows authentication or Windows claims authentication for your Web application and configure the TMG with HTML Form Authentication. The TMG will then collect the user credentials via a HTML form, similar to the one used by Outlook Web Access. No need to mess around with forms based authentication in SharePoint!

The TMG can also provide VPN access to your internal network. But for accessing the intranet I would prefer to also be able to access it publicly over SSL without the need for a VPN connection.

Configuring the TMG and publishing SharePoint sites, require many steps. See the article Publish a web farm using TMG 2010 for detailed instructions

  • This tends to be more secure than just giving a user open VPN access to the entire network. While TMG / UAG work very well, you can utilize other third party reverse proxies if you have access to those (even some of those open source flavors) depending on budget requirements. Jul 6, 2011 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.