2

NTLM or Kerberos.... which authentication is suitable for

  1. Intranet application?

  2. Internet application?

Will answer differ if 3rd party tools are used?

for MySite and ContentType Hub application which authentication should we follow?

if any web application has Form Based authentication NTLM or Kerberos which one will be correct approach?

Improve this question

2 Answers 2

Reset to default
3

You cannot use Kerberos for an Internet-facing system (as users cannot receive a ticket from the KDC), however you should use Kerberos for Intranet-facing systems when possible as it is faster as well as more secure.

Improve this answer
2
  • for MySite and ContentType Hub which authentication should we follow? if any web application has Form Based authentication NTLM or Kerberos which one will be correct approach?
    – Mdh22
    Commented Jun 23, 2013 at 15:09
  • 1
    MySites and ContentType Hubs are just site collections and follow the protocol in place for the webapplication. With FBA you can't use Kerberos unless you have a third party (UAG, NetScaler, BigIP, etc) that can delegate credentials.
    – Jesus Shelby
    Commented Jun 23, 2013 at 19:10
2

If users will never be connecting to backend system for intranet (using BCS) then NTLM suitable. Kerberos solves double hop issue, so Kerberos usually necessary if passing credentials if not using Secure Store Services.

There is no ONE solution here. Honestly, your environment and needs for data integration will hold your answer.

Improve this answer
2
  • if Secure Store Services is used for BCS then NTLM is OK for intranet? Trevor seward said different.
    – Mdh22
    Commented Jun 23, 2013 at 15:13
  • 1
    Kerberos is not required for Secure Store Services in intranet environment. In fact, Secure Store Services is one of the double-hop solutions in a NTLM environment. And when Secure Store Services can be used I am, typically, in favor. Trevor is exactly correct, however, in saying that Secure Store Services cannot be used in internet-facing environment because users cannot authenticate to AD. I am not sure about anonymous authentication with Secure Store as I have never tested. But I would generally say stay away from anonymous access to your secured data anyway.
    – JuanTrev
    Commented Jun 24, 2013 at 12:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.