1

I have a SharePoint 2010 Portal that uses claims based authentication with NTLM. The portal was published to TMG with site name something like staff.portal.com I have also installed certificates in SharePoint Server and updated bindings in IIS to use https and http. The AAM in SharePoint is also modified as below

default zone = http://staff.portal.com

Internet Zone = https://staff.portal.com

After configuring this I noticed few issues with SharePoint

Issue #1:

If I access the portal externally (via TMG login screen) and go to site permissions and click on Check permissions or site collection administrators link I get a blank page. The reason is url of the page still uses http instead of https.

Issue #2:

If I'm in the domain and try to open word or excel document it takes 2-4 minutes to load it. I suspect this is something to do with configuration in TMG. If I try to access the document externally via https the document opens instantly. To verify this I created another web application with Claims based with NTLM that is not published to TMG and if I access the documents it opens instantly.(within domain). So I'm pretty sure this is something to do with TMG.

Below is the current TMG configuration(partial). Could someone let me know if TMG is properly configured or if some additional steps are missing?

enter image description here

enter image description here

enter image description here

enter image description here

enter image description here

Improve this question

1 Answer 1

Reset to default
1

When publishing SharePoint sites to the Internet with SSL via ISA / TMG, you can deploy the SSL certificate to the TMG instead of the SharePoint web front-ends. With this configuration in mind, the TMG is responsible for the SSL encryption and communication between the TMG and the SharePoint front-ends is done in plain HTTP.

For this cenario, configuration goes like this:

Default zone:

Internet zone:

For the Intranet zone:

  1. extend the web application using the address http://staff-ssl.portal.com
  2. go to the Alternate Access Mappings page and change the address of the default url for the Internet zone to https://staff.portal.com
  3. add an alternate AAM to the Intranet zone that is http://staff-ssl.portal.com
  4. add this host header to IIS on all web front-ends

On the TMG you need to publish the site with the SSL certificate to the Internet and configure TMG to send requests to the web front-ends using the address http://staff-ssl.portal.com.

TMG receives requests from the Internet for https://staff.portal.com and sends these to the internal url http://staff-ssl.portal.com.

Because the address http://staff-ssl.portal.com is an alternate url for the Internet zone, SharePoint knows that all links present in the returned pages / or redirects if any happen use the url known to the Internet which is https://staff.portal.com - the default for that zone.

In your internal DNS server you must setup staff-ssl.portal.com and staff.portal.com pointing to the IP of the SharePoint server or load balancer.

In your external DNS server you must setup staff.portal.com pointing to the IP of TMG.

Because you have the same host header for both http and http endpoints, you won't be able to access the site internaly through HTTPS. It's better to setup diferent host headers for either zone and not just diferent protocols (HTTP / HTTPS).

Improve this answer
7
  • Hi Luis, do you think this will solve the slow opening of document?
    – Kannan Karmegam
    Jun 28, 2013 at 1:07
  • Hi Kannabiran, I've deployed a fair number of SharePoint extranets with this configuration with great results.
    – Luis
    Jun 29, 2013 at 23:18
  • Hi Luis, I want to use the same url either its within the domain or accessing externally. I believe the exten d web application is only if you want to use different url for internal and external access.
    – Kannan Karmegam
    Jul 2, 2013 at 11:13
  • Hi Luis, to isolate the second issue mentioned in my post, we have removed the Sharepoint application from TMG and tried to access it within domain. We noticed the word/excel document pops up a login prompt and even if we enter correct username/pwd it pops up login window and if we cancel it opens the document and i'm able to save but the experience is not consistent as the word/excel client freezes...
    – Kannan Karmegam
    Jul 2, 2013 at 11:16
  • If you want to use the same url for both internat and external use you don't have to extend, but if you want to use http for internal access and https (with SSL) for external access, then you need to extend.
    – Luis
    Jul 3, 2013 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.