I'm wondering what would be necessary configuration wise to setup an extranet, i've found a ton of articles that provide little peices to how the formula works but nothing that really links all of the components...

If i had a farm on the outside of my company firewall, i think i would need the following from what i've researched...am i missing something? The goal is to enable partners to access the content with Live ID's as well as allowing internal users the abiltiy to log in with their company domain accounts? This way they can collaborate.

I would need to create a claims based web application to host the team sites. I would need to some how work with my domain admins to get it to use Active Directory Federated Services that way i can leverage the Live ID's. I have read that using a Unified Access Gateway like forefront would be best as well.

At that point it should work? i'm probably missing alot of peices but i'm hoping someone can fill in the blanks and give me a better understanding of how it would work.

1 Answer 1


for that scenario you have two options:

  • First option: SharePoint trusting LiveID and ADFS
  • Second option: SharePoint trusting Windows Azure Access Control Service (ACS) and ACS trusting LiveID or ADFS.

First option

Second option

Personally, I like the second option since SharePoint is not friendly at all to manage those trust relationships (you can see from the tutorials). By using a "trust hub" you are also open to more options and keep the "trust policies" and claim transformation in a single place.

Also take into account that LiveID won't give you the email address of the user as a claim, it will give you just an opaque identifier that will be kept across logins, but you won't be able to configure in the people picker permissions for "[email protected]". You can only grant permissions to "all live id users". You might want to consider using Google which will give you the email if you have that scenario.

Finally, if you want an even simpler setup you can evaluate auth10.com which uses Windows Azure ACS beneath and will simplify both the setup and the management of those rules. Here are a couple of screencasts:

Full disclosure: I am a founder at auth10.

  • Thanks for this information it was very very helpful. when you speak about "Trust Hub" are you speaking about Azure as a trust hub? When you spoke about LiveID not giving back the email addresses of the users as a claim...so your speaking about when I’m trying to grant permissions to content once it is all setup, that leveraging Live ID's i would not be able to use the email addresses of the users....because there would be some sort of identifier that would not allow me to individually identify them? Does this apply to if i was using a people picker field in a list or library? Cheers!
    – Jacob A
    Commented Sep 28, 2012 at 21:16
  • 1
    1. Yes trust hub could run on Windows Azure ACS which provides LiveID, Google and Facebook as well as ADFS. 2. LiveID won't give you the email, that's right. 3. The people picker works differently when you are using SAML tokens. There is no "user repository" so the way it works is that you write a string in the picker like "[email protected]" and press ENTER, choose Email. Basically it is just a string, there is no auto-complete because SharePoint doesn't know where to get users from in a federated environment. There are ways to mitigate that by implementing a ClaimsProvider.
    – woloski
    Commented Sep 28, 2012 at 23:17
  • Excellent Help sir...much appreciate your time!
    – Jacob A
    Commented Oct 1, 2012 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.