Sharepoint 2013 Extranet, WAP or ARR

Question

We want to let our internal user access our SharePoint 2013 from Internet. Currently the sharepoint is running on HTTP, NLTM , user access from corporate network using http://servername.corporatedomain.com

We want to expose the sharepoint (all or some site collection) as https://www.publicdomain.com on internet for user access using their AD login/password.

We have some 'like to have' features in mind:

• SSL offloading, our sharepoint already setup using http, we don't want to change it
• if possible we want to restrict internet access to some site collection only
• For internet access, instead of default browser prompt for username/password, we may want to have custom login form, but behind the scene it validate username/password again AD.
• we may want to add multi factor auth in our custom login form
• the proxy server (either ARR or WAP) don't have to join AD

Can IIS ARR can do that? or I have to setup WAP and ADFS?

If both ARR and WAP can do the job, what is the better option?

Thanks.

Answer 1

While you don't need WAP or ADFS, you should be implementing a (pre-auth) Reverse Proxy of some sort within the DMZ to proxy traffic back to SharePoint and other applications that reside within the Intranet. This provides protection by terminating end user connections at the RP instead of all the way down to SharePoint. Some load balancers can also serve as an RP, such as F5 and others.

WAP and ADFS can be configured with a non-claims aware relying party, so you don't have to switch to SAML on SharePoint. You do need to implement Kerberos delegation, though. This is a good idea, however, as NTLM is insecure and prone to performance problems.

Answer 2

You might be misuing or misunderstanding the term "extranet" in the context of SharePoint. You do not need an extranet to allow your internal users access your SharePoint sites from Internet. SharePoint Extranet is useful when you want to have a Web Application does not use your AD for authentication and when you want to use this Web Application to share content with other companies.

So in your scenario, you just need to just need to assign public domains to all or some of your SharePoint Web Applications. You can also give Internet access to specific site collections only. These site collections would be called host-named site collections. Read the official documentation here.

Note that if you have multiple site collections in a web application, when you give Internet access to the root site collection, then all sub-site collections will automatically have Internet access as well.

You may not want to change from HTTP to HTTPS, but it is highly recommended (it should be a MUST), unless you want somebody to easily get their hands on the login credentials of one of your internal users and use the credentials to steal content from your internal SharePoint sites.

You do not need ADFS or WAP.

You can have a custom login form that prompts for the AD credentials: domain\username and password. This however cannot be done out-of-the-box. Also, this custom login page cannot be applied so that it shows only when access SharePoint from Internet, unless you use a web application that has been extended (more here).

---

Steps

Presuming you have an internal DNS server and that you also have a public domain, then you need to:

• Setup a sub-domain for each SharePoint Web Application (and site collection if you want to set up any host-named site collections) in your DNS server that points to the IP address of your SharePoint front-end server (or your Load Balancing server if you have multiple SharePoint front-end servers).
• Ask your domain provider to set-up the same sub-domains on their DNS server to allow for public access. I am not quite sure how this part works, I have always just handed the relevant info to Network Engineers.
• Add an SSL certificate to your SharePoint front-end server.
• Add HTTPS bindings to your SharePoint sites in IIS.
• Update the Internet URLs of your web applications in the Alternative Access Mappings in Central Administration. Read how to do this here.

This should be it.