5

I'm a bit confused about the different terminology, components and steps to make my scenario work.

I'm working on a SP 2010 platform that can have multiple authentication mechanisms : Anonymous, Integrated or external.

By external, I mean that the user have to log onto a unique corporate login page (out of SharePoint). The corporate login page, when authentication succeeds, redirect the user to the source page adding a token in the url. The corporate login also provides a way to validate the token (basically, an url having the token in the query returns ok or fail). This token can be validated only once.

What is the proper way to deal with this external login system (that cannot evolves) ?

the requirement is that the Sign in button redirect the user to the corporate login page. The OOB login form can't be used (but the authentication type selector can).

I'm quite sure than :

  • I'll have to set up claims authentication
  • I'll have to build a custom membership provider for FBA, that can validate my user against the corporate login system

What I'm not sure is how to plug everything. And I'm a bit confused by the concepts of identity delegation, claims aware service, SPClaimsProvider, etc.

Can someone help me by putting me on the right direction, and describe briefly the differences between these concepts ?

Improve this question

1 Answer 1

Reset to default
1

It sounds like you could use a custom security token service. There is a good walkthrough on MSDN for how to write an example custom STS. I'm picturing this is the part of the solution that handles your extranet access.

For anonymous and integrated access, I suggest you look at using multiple web applications or at least multiple zones for accessing the web application from different addresses for different authentication mechanisms. This will avoid the authentication type drop down selection box you refer to. Having multiple authentication types can confuse some externally connecting systems like old Office clients, Reporting Services and Performance Point to name a few.

Improve this answer
2
  • While this sample is very interesting, I'm not sure it applies. As I said, I cannot change the corporate login page. I'll have to deal with its own sequence of request. Or do you mean I can wrap the external authentication in a custom asp.net app (Sharepoint --> My custom app "claims aware" --> official corporate login ?
    – Steve B
    Mar 7, 2012 at 20:22
  • @SteveB In theory, yes. I believe that wrapping approach might work for you.
    – Tom Resing
    Mar 12, 2012 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.