4

Could anyone clearly explain

  1. what is Sharepoint authentication realm (the one set by Set-SPAuthenticationRealm cmdlet)?
  2. In what cases do I need to set this realm equal for 2 (or more) farms, and in what cases do I have to set the realm ID different for the farms?
  3. What are the possible usage cases of the authentication realm values?

As SharePoint's documentation, as usual, only covers the simplest and superficial terms/notions and cases, this info would be very useful.

Improve this question
2
  • Excuse me, but the "original question" does not contain any answers to my 3 questions. 1) there is no definition of the auth.realm - only samples of the cmdlet to change it. But why do I need to change it at all? WHY? is it so difficult to explain the role of this value in 2-3 sentences?! 2)-3) where is the enumeration of the use cases for setting realms equal/different between the farms? Too obvious to give examples again?! – Burst May 31 '18 at 20:34
  • Voted this question for reopen, as it might result in a very interesting discussion and collection of undocumented knowledge. – MHeld Jun 27 '18 at 10:39
0

The Authentication Realm is set when you establish an OAuth trust with a service, such as Workflow Manager, or SharePoint Addins.

The realm needs to be set to an identical value when publishing/consuming SharePoint Service Applications or during an upgrade when you need to bring Addins, for example a SharePoint 2013 farm with SharePoint Addins deployed, you would set the realm to an identical value in the SharePoint 2016 farm you're upgrading to.

Improve this answer
2
  • Does it mean that the authentication realm of a SharePoint farm is a kind of "logical grouping" of the interacting components in the farm: 1) add-ins, 2) farm itself, 3) other farms (consuming/publishing ones)? E.g. if I want an add-in to work within this farm, I have to register an App Principal with ID which includes that farm's realm (ClientID@RealmID). But why does an App Principal need the RealmID suffix? I use the add-in with a certificate (S2S, high trust) or with a client secret (low trust) and no other add-ins will use the same certificate or client secret. RealmID is not transferred. – Burst Jun 28 '18 at 19:29
  • Answering to your question , Realm is basically an identifier so that we know where the application request has come from and where the responses to those requests are going to. This is so we make sure that whoever is receiving the requests and sending the responses is a trusted entity. Please refer to the blog below and that should answer most of your questions asked above . Blog - sharepointwhoknew.wordpress.com/2018/10/08/… – Yash Kamdar Jan 1 '20 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.