SharePoint 2013 External Users

Question

I'm setting up a brand new SharePoint 2013 server and site, but haven't personally touched SharePoint since 2007. I don't want to use Windows Auth or any Active Directory for user management. Which, I believe, is leading me towards forms-based authentication (FBA) as the best option.

This article details all the steps to setting it up: http://sharepointsolutions.blogspot.com/2012/08/configuring-forms-based-authentication.html

Also I found the SharePoint 2013 FBA Pack (not released yet, but step-by-steps): http://blogs.visigo.com/chriscoulson/configuring-forms-based-authentication-in-sharepoint-2013-part-1-creating-the-membership-database/

This just seems like a lot of work when all I want is to create a few users and have them able to log in. I'm not even sure once I do the steps above whether user management can be performed within the SharePoint site, which I would really like to have, if possible.

Is this the best way to accomplish my goal? Any help/advice is greatly appreciated.

Answer 1

If you don't want to use Windows based authentication, some plumbing is always involved I'm afraid.

When using FBA, you indeed will have to manage your user database yourself. This cannot be done from within SharePoint by default, but I'm sure options exist to do this.

Another option is to go for claims based authentication. In that case you'll have to integrate with a SAML-compatible authentication provider like Microsoft's own ADFS, CA SiteMinder, Shibboleth, etc to handle authentication for you. These systems can connect to backend directories or databases to handle authentication for you. They can also federate with likewise systems at business partners so users can login with an ID they already have. More info at http://technet.microsoft.com/en-us/library/cc262350.aspx

You can also use a system like Azure Control Services to let users authenticate with a Microsoft Account, Google or Facebook ID. A nice guide on how to do this can be found here: http://www.wictorwilen.se/Post/Visual-guide-to-Azure-Access-Controls-Services-authentication-with-SharePoint-2010-part-1.aspx

When going the claims based authentication route there probably will also be a need to do some custom development because there is no user lookup or resolving mechanism provided out of the box.

Answer 2

Like Thomas said, you can take another road, but that one will require configuration as well (you need to make SharePoint trust that external Identity Provider and bind it to the Security Token Service which is not as easy as it sounds.

For your requirement, you could create, by code, a custom MemberShip Provider and rely on hardcoded users. Waldek has a nice article on his blog if I remember well (will try to find the link).

Otherwise, setting up FBA in SharePoint 2013 is not complicated. You'll need to create the database (and you can use the built-in asp.net wizard which will do 95% of the job : aspnet_regsql.exe) to store your profile AND roles (if you need groups). You just name the user identity, email & password, you can nearly safely discard everything else if the various tables. You can use the default user management backend from asp.net to feed your users.

Make sure that the Security Token Service Application Pool identity has enough access on it (same goes for your target site application pool and central admin app pool if you want to manage them from here)

Then register your Membership providers in the STS web.config and on your web application (and as explained on the central admin if needed) and in your web application specify that it's a FBA one.

It might seem a lot of work but there are tens of guide on the web to do it in SP2010 and it's working the same way in 2013 so no need to wait for SP2013 dedicated resource.

I never had the opportunity to do it in SP2007/2010 but had to deploy it recently in SP2013, once you know where you need to go, trust me, it's done in a less than 1 hour.

A good article about it : http://weblogs.asp.net/sreejukg/archive/2011/06/19/configure-form-authentication-in-sharepoint-2010.aspx

Answer 3

The good news is that the SharePoint 2013 FBA Pack has now been released, and you can use it to manage your FBA users from within SharePoint. You can get it here:

http://sharepoint2013fba.codeplex.com/

As for it being a lot of work to setup FBA in SharePoint, like Francois mentioned in his answer, it's really not that bad. It looks like a lot of steps in the article because of all of the screen shots I included - but really all you need to do is create the database with the wizard, and then add a few lines to the web.config files.

Answer 4

It's really not that bad to setup FBA. It doesn't take that long setup. As long as you read each step carefully you shouldn't have any trouble. It only sucks if you're going to fast and skip a step. Sometimes troubleshooting can be a pain.

Those post are helpful. The FBA pack makes setting up users very easy. Here is a post I did about setting up FBA. I tried to include screenshots for every step. http://wp.me/psiID-6Z