SharePoint Saturday The Conference 2011 - Extranets & Claims Authentication

transcript

SharePoint 2010 Extranets & Authentication

Welcome to SharePoint Saturday—The Conference Welcome to SharePoint Saturday—The Conference

• Please turn off all electronic devices or set them to vibrate.

• If you must take a phone call, please do so in the hall so as not to disturb others.

• Open wireless access is available at SSID: SPSTC2011

• Feel free to “tweet and blog” during the session

• Thanks to our Diamond and Platinum Sponsors:

Thank you for being a part of the first SharePoint Saturday conference

About Brian Culver

– SharePoint Solutions Architect for Expert Point Solutions

– Based in Houston, TX

– Author • SharePoint 2010 Unleashed

• Various White Papers

– Speaker and Blogger

Session Agenda

• Extranet Definition

• Common Extranet Scenarios

• Extranet Design Considerations & Challenges

• Claims Based Authentication and other Authentication Scenarios

• Mixed Mode vs. Multi-Authentication

Extranet - Definition • A web application that is shared with external

users, such as partners, vendors, and customers

• Common attributes for an extranet: • Sharing a private network or secured network

• Requires authenticated access, but the identity of the consumer is not always known

• Has better security controls than an Internet Web application but usually less secure than the Intranet

• Web application

Common Extranet Scenarios

Line of Business Applications

Collaboration Static Content or Publishing

Remote Employees

Isolate and segregate internal data.

Authorize to use only sites and data that are necessary for their contributions.

Restrict partners from viewing other partners’ data.

Partners

Target Content

Segment content Limit content access and search results based on audience.

Vendors & Customers

Extranet Design Considerations & Challenges

• Network Topology and Access

• Identity Management – Seamless Single Sign-on Experience

• Content Security and Access

• Antivirus – Client

– Server

• Rich Client Experience (Office Integration)

Edge Firewall Topology

Back-to-Back Perimeter Topology

Split Back-to-Back Topology

• Authentication is the mechanism whereby systems may securely identify their users – Creates an identity for security principal – Who am I?

• Authorization is the mechanism by which a system determines what level of access a particular authenticated user should have to secured resources controlled by the system. – Determines what resources an identity has access to – What can I access?

Security Terms

• SharePoint does not authenticate – Windows authentication via Windows server and IIS

(Kerberos/NTLM)

– FBA via ASP. NET and authentication providers (SQL, LDAP, etc.)

– Web SSO via Active Directory Federation Services (ADFS) and other Identity Management Systems

• SharePoint creates user profiles – SPUser object represents security principal

– User Profile List in Site Collections track user profiles

SharePoint Authentication

• SharePoint 2010 changes authentication – Uses classic mode and claims based authentication

– Classic mode is SharePoint 2007 style legacy mode

– Claims-based authentication is the new security model

• What are the benefits? – Claims decouples SharePoint from the authentication provider

– Allows SharePoint to support multiple authentication providers per URL

– Identities can be passed without Kerberos delegation

– Allows federation between organizations

– ACLs can be configured with

– DLs, Audiences and OUs

SharePoint 2010 Security

Identity Normalization

• Identity: security principal used to configure the security policy

• Claim (Assertion): attribute of an identity (such as Login Name, AD Group, etc.)

• Security Token: serialized set of claims (assertions) about an authenticated user.

Claims-Based Terminology

Claim-based Authentication

• Security Token Service (STS): builds, signs and issues security tokens. It can receive and submit tokens.

• Issuing Authority: identity management system(s) that “knows” the claims (AD, ASP.NET, LiveID, etc.)

• Identity Provider: trusted party that creates and submits claims

• Relying Party: application that makes authorization decisions based on received claims

Claim-based Authentication

Mixed Mode Authentication vs Multi-Authentication

Regular label-callout text

Multi-AuthenticationMixed Authentication

SharePoint

Web Application

Extended Web Application

Zone: Custom

Zone: Extranet

Zone: Intranet

Zone: Internet

Zone: DefaultWindows

Authentication

SharePoint

Web Application

Extended Web Application

Zone: Custom

Zone: Extranet

Zone: Intranet

Zone: Internet

Zone: DefaultWindows Authentication

FBA Authentication

SAML Based Authentication

FBA Authentication

Windows Authentication

Auth Scenarios - Mixed Mode

Authentication Scenarios Mixed Mode: When to Use It

Auth Scenarios - Multi Authentication

Authentication Scenarios Multi Authentication: When to Use It

Authentication Scenarios Multi Authentication & Mixed Mode

FBA Claims Configuration

1. Run C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe

2. Enable Claims Authentication on Web Application via Central Administration

3. Modify web.config for the FBA Web Application

4. Modify web.config for Central Administration

5. Modify web.config for Security Token Service – %programfiles%\common files\Microsoft Shared\web server

extensions\14\WebServices\SecurityToken

– Changes need to be made to the Security Token Service virtual directory on each server hosting CA or the claims-based web application

6. Configure FBA Provider in Central Administration

7. Create Web Application Policy to give SQL Auth User(s) access to site

Claims Configuration

Web Application web.config

</providers></roleManager> <membership defaultProvider="i“> <providers>

</providers> </membership> </system.web>

Central Admin Web.config

</providers>

</roleManager>

</providers>

</membership>

Secure Store Web Service web.config

</connectionStrings>

<system.web> <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false“> <providers>

</providers> </roleManager> <membership defaultProvider="i"> <providers>

</providers> </membership> </system.web>

Claims Configuration

Issues using Claims Authentication

• "Search Alerts only work with Windows Classic Authentication“

– http://technet.microsoft.com/en-us/library/cc288475.aspx

• Performance Point Dashboard Designer doesn't work directly against a web application with multiple authentication providers

– http://technet.microsoft.com/en-us/library/ee748637.aspx

Issues using Claims Authentication

• Some issues have been reported with Infopath Forms Services, PowerPivot and Performance Point Services

• Project Server won't create new sites on a claims-based authentication web app but don't see a reference for it

Welcome to SharePoint Saturday—The Conference

Thanks to Our Other Sponsors! Thanks to our Sponsors

Questions

Brian Culver, MCM

Twitter:

@spbrianculver

E-mail:

brian.culver@expertpointsolutions.com

spbrian.blogspot.com

Welcome to SharePoint Saturday—The Conference

Session Evaluation Please complete and turn in your Session Evaluation Form so we can improve future events. Survey can

be filled out at:

http://app.fluidsurveys.com/surveys/spstc2011-

and add the Session number to the URL

Presenter: Brian Culver

Session Name: SharePoint 2010 Extranets and Authentication: How will SharePoint Connect you to your Partners?

Session No.: Sat-S5A-101

Useful Links

• SharePoint 2010 FBA User Management

• SharePoint 2010 Forms Based Authentication Configuration Manager http://blogs.technet.com/b/speschka/archive/2010/07/28/sharepoint-2010-

forms-based-authentication-configuration-manager.aspx

SharePoint 2010: transparent login with mixed authentication http://www.orbitone.com/en/blog/archive/2010/06/23/sharepoint-2010-mixed-

authentication-automatic-login.aspx

Steve Peschka article’s on Forms Authentication » Forms Authentication in SharePoint Products and Technologies (Part 1): Introduction » Forms Authentication in SharePoint Products and Technologies (Part 2): Membership and Role Provider Samples » Forms Authentication in SharePoint Products and Technologies (Part 3): Forms Authentication vs. Windows Authentication

SharePoint Saturday The Conference 2011 - Extranets & Claims Authentication

Technology