0

I am a development manager and one of the sys admin and I are trying to build a "Client Extranet", which is a fancy name for a SharePoint 2010 web application with sites that employees and clients can use together, probably just team sites.

So I understand from the sys admin that best practice is to configure SharePoint to use both Windows Auth + ASP.NET Forms Based Authentication with the FBA users being the clients. No problem, that seems straight forward enough.

However, we don't want any FBA user, aka our clients, to ever be able to see all of the other FBA users through the directory. In other words, we are concerned that an employee who is a windows user, will stick an FBA user, one of our clients, into the Administrators Group or assign a permission level that would allow that FBA user to then manage users and thus see all of the other FBA users.

Is there perhaps some event that I could handle that would allow me to put some code in that checks if an FBA user is being given a permission like "Administer the site" and stop it?

Improve this question
1

I'm not sure if this is a Best Practice but I can tell you one solution I've seen that seems to work quite well is to break out each Client/Organization/Company into its own Site Collection under the same web application. This keeps the authentication the same, allows for the same client to access multiple sites they might have permission to and, most importantly, keeps each client/organization/Company completely isolated.

There are a few drawbacks to this approach though. The primary one being that it is not possible to do any queries that involved data in different site collections.

Improve this answer
4
  • I apologize. I should have specified that this is already how they want it organized. There will be one site collection per client. However, I don't understand how that answers my question. When you click the directory to add a user to a site, you can see all FBA users listed, right? – tnktnk Jul 26 '12 at 17:57
  • I just verified and I can only see users in the site collection when using the directory from people picker. I did not set up the specifics of our FBA here but it appears to be pretty standard stuff (msdn.microsoft.com/en-us/library/bb975136%28v=office.12%29.aspx) – Dave Wise Jul 26 '12 at 18:41
  • That will work then. Last question: how did you go about getting them into the site collection in the first place if you can only view them in people picker once they are there? – tnktnk Jul 26 '12 at 18:52
  • I would assume the usual way - as Provider\UserID but I'm honestly, I'm not sure as the help desk normally handles user requests. – Dave Wise Jul 26 '12 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.