I am trying to setup hybrid environment using SharePoint 2016. One of the requirements of that is to create reverse proxy. I am using ADFS to setup reverse proxy. Now my question is do I need to use Kerberos authentication to set up reverse proxy for SharePoint?

  • What hybrid feature(s) are you planning on using? – Trevor Seward Jul 1 '16 at 14:31
  • I have already implemented Onedrive and Site, which does not require any reverse proxy. But I am stuck while implementing BCS, which requires reverse proxy. – Sudip Ranjan Sil Jul 1 '16 at 15:05

Looking at the 2013 Hybrid Setup, there are no traces of a requirement for using Kerberos authentication. However, you need to have your on-premises Web Application already accessible from the internet, preferably using the extranet zone of Alternate Access Mapping.

General reverse proxy requirements

In a hybrid SharePoint Server 2013 scenario, the reverse proxy must be able to:

  • Support client certificate authentication with a wildcard or SAN SSL certificate.
  • Support pass-through authentication for OAuth 2.0, including unlimited OAuth bearer token transactions.
  • Accept unsolicited inbound traffic on TCP port 443 (HTTPS).
  • Bind a wildcard or SAN SSL certificate to a published endpoint.
  • Relay traffic to an on-premises SharePoint Server 2013 farm or load balancer without rewriting any packet headers.

Tip: No ports other than TCP 443 need to be opened on the external reverse proxy endpoint to support hybrid connectivity.

Reference: Configure a reverse proxy device for SharePoint Server 2013 hybrid

Looking at 2016 there is still no available info on reverse proxy settings for the Hybrid environment. However, there is an article discussing the outbound traffic (on-premises to Online) where standard NTLM authentication applies. NTLM and Kerberos are both claims authentications and it would be unlikely to require Kerberos in the reverse proxy scenario and not the outbound scenario.

Outbound requests to SharePoint Online can be made from any web application in the on-premises SharePoint farm that uses Integrated Windows authentication using NTLM...

Reference: Plan server-to-server authentication

My advice would be to go without Kerberos, and follow the guide of 2013 all the way through. But (as always) this may be changed in the future.

  • 1
    Much appreciated for the answer. I am not able to setup Kerberos some how. I am using Azure ARM vms for my farm. Will try to configure BCS without using Kerberos. – Sudip Ranjan Sil Jul 4 '16 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.