We are using Sharepoint 2013, and AD authentication works properly. We think about creating subsite dedicated to external users without AD accounts.

I've google it, so I think the best solution is to use FBA (as informations are store on sql db).

But I'm not sure I understand everything as I want. Can we combine FBA and AD Authentication ? So internal users are able to log through the AD and external ones with the FB ? Can we personalize users' right on site/subsite/lists correctly via FBA ?

If you have any links that can explain me all I have to know about FBA and the combination with AD auth., let me know

Thanks in advance.

P.S : Please, forgive my English P.S2 : Since I saw this screenshot, I'm pretty sure that they FBA/AD can work together. But how sharepoint does, to decide which authentication it will use ?

3 Answers 3


When you use FBA on a claims based SharePoint site, you get a page when you enter the site url with a dropdown. There you can select internal (intranet) or external (fba).

  • The other option is to extend the webapp on another URL. One URL can be used for windows auth, the other for FBA. Probably more work than it's worth, but it would prevent having to choose the auth mode by dropdown I believe.
    – user24313
    Mar 20, 2014 at 17:59
  • I will look this way @user24313, thanks for your reply, if you have a link that goes through that, would be wonderfull. Have you ever test it ?
    – Nico
    Mar 21, 2014 at 8:05

To expand on my comment, check out these links

How to: Expose a SharePoint Application to the Extranet and Use Forms-Based Authentication

AAMs *Explained : Redux (and Presentation)

The first article is a brief rundown of how to do precisely what you want to do: extend an SP web application into 2 IIS web applications, each with different authentication mechanisms. This is a fairly well documented solution and to my knowledge is a primary use case of extended webapps and thus fully supported by MSFT.

The second article is a little bit more generally about Alternate Access Mappings and how they relate to extended webapps. In this article they also cover how their "foo" site is an external portal using a custom claims provider (IIRC it's more general than a forms case like you'd likely want to use) and how to use the AAMs to get a well tuned internal/external experience including http>https redirection via the AAM infrastructure (it's pretty clever.) Give both a read and I suspect that should well answer your question.

  • Thanks a lot @user24313 ! I will do this in this week and come back if I have something to say
    – Nico
    Mar 22, 2014 at 18:34

I think i've found the explanation and proof that both can work properly together :

When authenticating to the site collection, if you enabled both Windows Authentication and Forms Based Authentication, you’ll be prompted for which method you’d like to use to authenticate.

Source (quote part 4) : configuring-forms-based-authentication

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.