SharePoint - Publish internet site with reverse proxy, NTLM Authentication , and FBA

Question

I need to publish a SharePoint internet web site by implementing the three-tier network zoning, it will be determined as follows:

1- Reverse Proxy Server resides in Internet DMZ Zone.

2- All SharePoint Servers (Application & WFE) will reside in the internnal network.

3- Database servers (clustered) will reside in another protected zone, and connections are made through a specific port (as mentioned in the securirty hardeding plan by Microsoft)

My question: is it possible to get my internet web site work normally with NTLM authentication and FBA after exposing the WFE to the internet via Reverse Proxy?, knowing that my web application is configured to use Claims Based Authentication (NTLM + FBA). or is there a specific configuration that needs to be applied on the Reverse Proxy Server to get the web site work properly using NTLM and FBA?

I couldn't find clear information about this, somesay that I should use ADFS with the reverse proxy, but I don't want to use it.

Answer 1

So, in summary you'll have to complete below main steps.

1. Determine port numbers and Create Firewall Rules from DMZ to Internal network and from Internal network to database zone.
2. Install an configure SharePoint farm in internal network.
3. Create a web application in SharePoint by providing an internal URL using windows authentication.
4. Extend that web application to the public zone with the public URL with forms based authentication. (This will create a separate web site in IIS). This URL should be the public URL that you need to access from internet.
5. Implement and deploy any custom authentication any required providers for the forms authentication with any branding changes like master pages and page layouts as a WSP solution package.
6. [Make sure forms authentication is working.][1]
7. Install and Configure reverse proxy server in DMZ zone. Configure the reverse proxy for the public URL based on the reverse proxy server instructions. [There is a reverse proxy module for IIS as well][2].

ADFS is not required to configure reverse proxy as far as I'm aware. If you have SharePoint servers in DMZ zone you would need to configure ADFS to authenticate internal users for the intranet. However, in this case it's not a requirement.

Helpfull PowerShell Scripts to create an extend the web application

#Create the web application in SharePoint 
#=========================================
$ap = New-SPAuthenticationProvider
New-SPWebApplication -Name "AuthoringApp" -Port PortNo -ApplicationPool "AppPoolName" -ApplicationPoolAccount (Get-SPManagedAccount "domain\username") -DatabaseName   SharePoint_Content_Authoring -DatabaseServer "DBSERVER\Instance" -AuthenticationProvider $ap -DatabaseCredentials $dbcreds -Url https://authoring.domain.com -SecureSocketsLayer


#Extend the web application to the Internet zone
#================================================
$ap = New-SPAuthenticationProvider -ASPNETMembershipProvider "CustomAuthProviderName" -ASPNETRoleProviderName "RoleProviderName"
Get-SPWebApplication -Identity http://authoring.domain.com | New-SPWebApplicationExtension -Name PublicApp -Zone Internet -Port portNo -AuthenticationProvider $ap -AllowAnonymousAccess -Url https://public.domain.com -SecureSocketsLayer