How to make my SharePoint 2013 intranet (Host named site collection) to be accessible from internet. I will implement 2FA with the help of any 3rd party and will take care of authentication. Can i just create an alternate access mapping keeping the same windows claims authentication and move forward.
You should set up a ReverseProxy with Preauthentication in front of your SharePoint Farm like WebApplicationProxy.
WAP provides a lot of useful stuff:
- Security is increased, because only authenticated users can communicate with SharePoint
- You can pass one authentication to multiple backend-applications (SharePoint Portal, MySites, Provider Hosted Apps, ...). You can choose between Kerberos and Claims-Tokens. This feature has been improved on Windows Server 2016.
- MultiFactorAuthentication is an optional feature
- Integration to Office client apps can be improved by using persistent cookies (no login required when opening a document)
Implementing ADFS+WAP is not the easiest task, but it's absolutely worth it.
At the WebApp level you will need to edit your authentication settings to enable Anonymous authentication.
Then, set the Anonymous Access Policy for the web app to define what anonymous permissions are available.
Finally, in the site collection itself, grant the required permissions to the anonymous user (it's in the ribbon when on the permissions page).