Can some please tell me how to grant external users access to SharePoint external facing site? I have a SharePoint 2013 Enterprise Standalone server.

  • How are "internal" users accessing the site now? Do you have an external authentication source you control? or would you rather use other authentication sources (Microsoft ID, Facebook, OpenID types of things?) – lwbecker2 Dec 6 '12 at 20:14
  • internal users are authenticating through AD once they are given access to the site. I would rather not give external users AD accounts and we currently do not have an external authentication source. Can you please give me some suggestion of good ones. Also, is there away to do it with out an external authentication source? Can sharepoint do the authentication if the site can be viewed externally? – Kevin Dec 6 '12 at 20:23
  • you could have a separate AD that you then make a one way trust ? – Oddmar Dam Dec 6 '12 at 21:10
  • Ok if the site is already externally can I just create local users on the SharePoint Server and have them authenticate that way. If so is there any security risk in doing that way? – Kevin Dec 7 '12 at 15:52

For external access I would suggest using identity provider with SAML authentication.

SAML token-based authentication

SAML token-based authentication in SharePoint 2013 uses the SAML 1.1 protocol and the WS-Federation Passive Requestor Profile (WS-F PRP). It requires coordination with administrators of a claims-based environment, whether it is your own internal environment or a partner environment. If you use Active Directory Federation Services (AD FS) 2.0, you have a SAML token-based authentication environment.

A SAML token-based authentication environment includes an identity provider security token service (IP-STS). The IP-STS issues SAML tokens on behalf of users whose accounts are included in the associated authentication provider. Tokens can include any number of claims about a user, such as a user name and the groups to which the user belongs. An AD FS 2.0 server is an example of an IP-STS.

SharePoint 2013 takes advantage of claims that are included in tokens that an IP-STS issues to authorized users. In claims environments, an application that accepts SAML tokens is known as a relying party STS (RP-STS). A relying party application receives the SAML token and uses the claims inside to decide whether to grant the client access to the requested resource. In SharePoint 2013, each web application that is configured to use a SAML provider is added to the IP-STS server as a separate RP-STS entry. A SharePoint farm can represent multiple RP-STS entries in the IP-STS.

enter image description here

Reference: Plan for SAML token-based authentication

More to read: Design Sample: Extranet with Dedicated Zones for Authentication for SharePoint 2013

| improve this answer | |

i have the same situation, in my case i have 3 sites sharepoint (internet, clients [Extranet], employé [Intranet]), so, i using anonymous access for internet site, and of course windows authentication (active directory) for intranet, and for clients (external users) i use Forms-Based Authentication with SQLMemberShipProvider like that i separate external users and internal users, just if you can use separate web application between this 3 sites its better.

like that you can ensure a separation between your environments, and easy to manage it.

if you can't have multiple web application, of course you can use only one web application and activate anonymous (if you want) and use multiple authentication (windows authentication for local users and forms authentication for external users)

good luck

| improve this answer | |

It all depends on the what the external users are exactly looking for and what information/attributes they can pass for authentication .

1 -> If the external users are interested to use gmail , fb or linked accounts for login to Sharepoint app , you can implement OpenID .

2 -> Site Minder can be used for authentication of external users

3 -> ADFS , IDAM can also be used .

4 -> If there is need for SSO -> Use Ping Identity OR create a custom STS which accepts SAML tokens . You will need more understanding on IDP and SP initiated approaches if SSO .

Finally if you are saying external users are anonymous users , then make web app as anonymous :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.