I have two Sharepoint sites. These are accessed by users both internal and external to the company.

The internal users log in to both automatically, the external users have to login any time they want to use either site. The login for both is the same.

Is there any way to ensure that if an external user has logged in to one site, they automatically log in to the other as well? I have some hyperlinks in the sites which link to documents in the other site. These links work fine for internal users but do not work for external users; if they click it they get an error message. If they copy and paste the link and put it in a new browser, it will work; however they will still need to login again even if they have logged in to the first site successfully.

How can I get these hyperlinks to work?

Thanks, TG.

  • What authentication method do you use for the external users? FBA, Windows, Claims or Kerberos?
    – Dave Wise
    Oct 25, 2011 at 15:10
  • Are the sites within the same web application? For example sharepoint/sites/site1 and sharepoint/sites/site2? Oct 25, 2011 at 15:16
  • And what's the error message? Oct 25, 2011 at 18:30
  • Hi Dave, Mike, Jesus, thanks for getting back to me. I'm trying to find out the authentication method at the moment- I've just started maintenance of the server with no prior Sharepoint experience so am still trying to figure out how to find this out. The sites have URLs in the format Server1.mycompany.co.uk and server2.mycompany.co.uk if that's what you mean, as Benjamin suggests below. The error is a 403 Access Forbidden error. Oct 26, 2011 at 8:36
  • Theresa - you can find out in either Central Administration under "authentication providers" or within IIS itself. Oct 27, 2011 at 7:42

1 Answer 1


It would be handy if you could share the format of the URLs with us, as well as let us know whether the sites are located in separate Web applications.

It's likely the the links work fine for internal users because they are domain joined and their Web browsers consider the sites to be in the local intranet (e.g. if the domain is called "company.com" and your SharePoint sites are called "extranet.company.com" and "intranet.company.com".

There are a few ways you can achieve a "single sign on" experience aside from ensuring users are domain joined:

  • Issue a cookie for a domain that is valid for all relevant URLs (example below)
  • Issue tokens that include the relevant URLs as part of the same security realm (clients still receive a SSO cookie in this case that references a token in the SharePoint token cache). See Claims-Based Single Sign-On for more details.

We achieve a form of "sso" by deploying Microsoft ISA server 2006 as a reverse proxy server. The great thing about it is that you can implement it at the edge, often with no change to your SharePoint environment and it's very useful in an extranet scenario.

ISA can issue a cookie that is valid for multiple sites (assuming the host names reside within the same domain), even if the sites reside within separate Web apps.

e.g. if you have client.company.com and client2.company.com you could issue a cookie for .company.com which would be valid for both sites.

BTW, I don't work for Microsoft - I just think ISA server and ForeFront TMG (ISA's replacement) are cool products.

  • Hi Benjamin, you are correct; the sites have URLs in the format server1.mycompany.co.uk and server2.mycompany.co.uk. The link you gave looks like what I'm looking for; I'll try to get my head around that. I have programming experience but very little in Sharepoint, or any other server experience, so this will be a good learning process. Oct 26, 2011 at 8:45
  • I would tread very carefully if you are currently using "classic" authentication and are considering moving to claims for SSO. I suggest reading through this article which details some of the considerations: technet.microsoft.com/en-us/library/cc262350.aspx Oct 27, 2011 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.