6

These zones, and their labels, are just labels. There is no functional difference between the five. However, these labels indicate to the next administrator how they are used, and what they are for. You may not need more than one zone to use different authentication methods. In fact, Microsoft "recommend that you implement multiple authentication methods on ...


5

As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...


4

IMHO - I reproduced the issue you are having on one of our systems except for the use of Claims authentication. My search account does have 'Read' access for the web application. A list was created and anonymous access was initially enabled from inheritance. The search index was already built (it is scheduled to run often) and could query the list as ...


4

If you extend a WebApplication you have to have some difference in the url (could be http vs https) otherwise SharePoint has no way of knowing which zone you're in. But if you're using SharePoint 2010 then you don't need to extend to get the behaviour you want. If you enable both Windows and FBA in your zone the default Login Page provides a LogonSelector ...


3

I have found the answer guys use Remove-SPWebApplicationAppDomain


3

When you extend a Web Applications It will create another IIS sites and use the same App Pool as Main Web App But using the Same Content Database and no new site collection will be created, as it will use the same content. Let me explain with a simple Example. I have requirement to create a Portal which will be used by our internal User(intranet) and ...


3

When you extend a SharePoint web application, you are telling SharePoint to go to IIS and create a new site, but SharePoint will use it to show the same content. You would normally do that to support different security, authentication and URLs between an Internet site, Intranet and Extranet, for example. When you add a host header it is equivalent to going ...


3

SharePoint uses the default URL for links in alerts and workflows that are automatically kicked off. Regarding alerts the only real way around this is to change the URL of the Default zone. This can be done in CA with the AAM, by the cmdlet Set-SPAlternateURL or (my preference) delete the web application (preserving the data of course) and creating a new ...


2

It's not a short or simple article but I think it applies to your issue: Trim SharePoint Search Results for Better Security Microsoft SharePoint search uses an account that usually has full read access across the repository to index its contents. So it’s important that when a user queries for some content, he should be restricted to view only the ...


2

var webService = SPFarm.Local.Services.OfType<SPWebService>().FirstOrDefault(); if (webService != null) { var webApp = webService.WebApplications.FirstOrDefault(wa => wa.GetResponseUri(SPUrlZone.Default).Port == 80); if (webApp != null) { Uri webAppUri = new Uri(webApp.GetResponseUri(SPUrlZone.Default).AbsoluteUri);


2

You could create a VPN network from your home to your office network. (Recommanded) Alternate access mappings isn't just working for External access, you need to configure too in your router and your DNS server, that's a little complexe in this situation.


2

Yesm You can only change the url of the root site collection of HNSC. Here is what technet is describing; The Set-SPSiteUrl cmdlet only applies to the root site collection for a host name that is, http://www.contoso.com. This cmdlet cannot be directly run against a managed path site collection underneath the root that is, http://www.contoso.com/...


2

You only need the default zone in the Content Source. Queries executed from other zones will return results mapped to the source in the same zone (unless it's missing in which case it will fail back to the default zone).


2

See the following answered question for more info on this. Whats the difference between host headers and alternate access mappings? SPDoctor has a very good explanation on the difference between the 2 methods for managing IIS and host headers for your SharePoint server. It is always best to let SharePoint handling IIS by extending the web application ...


1

To answer your question from my experience, yes most companies opt for Windows Auth with NTLM. Some opt for Kerberos (and I steer them that way), which is faster/more secure. Others yet will go the SAML route, but that's on the rarer side of implementations. You can have multiple authentication providers without extending a Web Application. And in fact, the ...


1

Try the following steps: In the CSWP query builder, go to the Refiners tab Click the little “Show more” link at the bottom In the "Group By" dropdown, select "—Show all properties—" and then select DocumentSignature. After that click OK and save webpart. Check the screenshot below: This should work , but still it doesnt work, then export the webpart, find ...


1

There's mainly two options: Use a VPN, and access you SP sites as you would do from the inside of the network. "Publish your SP server on the Internet":Usually, you use a dedicated server known as a "publishing server" or a "reverse proxy" (like Microsoft TMG). That server has a public IP address (and you register a public DNS name to point to it). When ...


1

when you extend a web application, at that you can enter the url. or leave it with server & port numbers. Once the Web app extend, you can go the Central admin > Application managment > Configure the Alternate Access Mapping. Now on this page, select the web application click on edit the Public URL. Over here you can enter the DNS / URL what ever ...


1

I fixed it, but I don't understand why it wasn't working in the first place. I found this article that helped me, but it didn't provide a direct answer: SharePoint 2013: Access Denied to Root Site of Web Application In the article I linked the issue experienced was in 2013 (my environment's issue was 2010), and the access denied was only occurring on the ...


1

I haven't had an answer saying this wasn't safe, and I used the code and it seems to work fine. If anyone finds a condition where this is invalid, please post it as an answer. Until then I'm going to close this question out.


1

If you extended the web application to an additional site in IIS, that zone can be configured to have different authentication mechanisms.


1

I think it is possible to add forms users if you created a third zone with both authentication methods, but I haven't tried it myself. Your suggestion of making a custom login page might also work.


1

Yes, I think that's possible. You will need to extend the webapplication to an additional virtual directory in IIS. Then you should have two virtual directories in IIS for the same web application. Then you can configure the ssl and anonymous differently.


1

You should extend your web app and use a different zone for which you use the claims Auth (for instance the Intranet zone). Let the Default zone use NTLM Auth and crawl that zone. Search can only crawl using windows Auth. And the default zone should be the most secure.


1

Is seems as if the module hasn't been added correctly to the web.config for the alternate zone. Have you compared the web.config for the two zones?


1

You should extend your web app and use a different zone for which you use the Forms AuthN (for instance the Intranet zone). Let the Default zone use NTLM AuthN and crawl that zone (always use the Default zone as your most secure zone, since it is the fallback one).


1

Zones are just markers. You can easily remove them from via CA under AAM (Alternate Access Mappings, just clear out everything but what resides in the default zone. You could just as easily leave everything as is and just allow access to the default zone. You can do this via deletezoneurl in STSADM ( http://technet.microsoft.com/en-us/library/cc288187(...


1

Certificates can only be applied at the WebApp level in IIS, and you can only assign one certificate per application. Unless you are using a reverse proxy that will change the URL's you will need a cert that covers each URL you will be accessing with SSL enabled. Because your URL's utilize different domain names, you can not take advantage of a wildcard ...


Only top voted, non community-wiki answers of a minimum length are eligible