I have a provincial government client who we're deploying a SharePoint 2013 Standard farm. Because we're a 3rd party consultant they are reluctant to expose their AD and allow us to ADFS single-sign on.
My manager thinks as an alternative we'll just create our own AD and whenever a user needs a SharePoint account the client will open a ticket and we'll create the account. When the user forgets their credentials or needs to be removed, same thing. This is what we do with our current clients and half my tickets are "Reset password" or "Create new account". It's a waste of my time really. Doesn't sound like the best method to me. I'd rather use a solution the client has more control over instead of having to contact us whenever they need to deal with user accounts. Additionally we'd have to do this work for free since the client can't do it themselves.
I deployed FBA Pack 2013 on a test farm and it seemed to work pretty well. Any site collection admin can create, manage and remove users right from the front-end, eliminating any work we have to do in that regard, but apparently FBA is losing favor and isn't the most secure method? He mentioned vulnerability to zero-day threat. I don't really know anything about that, but I figure if you know the threat exist, you're half way to securing it.
I just need to know if FBA truely is a bad idea given the security requirements we need to meet, being a government entity and all. If it's not, is there a better alternative then recreating the user accounts in our separate AD and managing them ourselves which I'd rather not do.
The solution we pick is also influenced by which reduced (hopefully eliminates) credential prompts when working with SharePoint.