SharePoint 2010 Extranets and Authentication: How will SharePoint 2010 connect you to your partners?
Download as PPTX, PDF12 likes9,303 views
The document discusses SharePoint 2010's capabilities for creating extranets and managing authentication for external users such as partners and customers. It covers key topics including extranet definitions, design considerations, authentication methods (claims-based vs classic), and common scenarios for access control. The advantages of claims-based authentication are highlighted, emphasizing its flexibility in handling multiple identity providers and improving security measures.
SharePoint 2010 Extranets and Authentication: How will SharePoint 2010 connect you to your partners?
- 1. SharePoint 2010 Extranets and Authentication:How will SharePoint 2010 connect you to your partners? Brian Culver, MCM, MCPDSolutions ArchitectExpert Point Solutions3/23/2010
- 2. Session AgendaExtranet DefinitionCommon Extranet ScenariosExtranet Design Considerations & ChallengesClaims Based Authentication and other Authentication ScenariosMixed Mode vs. Multi-Authentication
- 3. Extranet - DefinitionA web application that is shared with external users, such as partners, vendors, and customersCommon attributes for an extranet:Sharing a private network or secured network
- 4. Requires authenticated access, but the identity of the consumer is not always known
- 5. Has better security controls than an Internet Web application but usually less secure than the Intranet Web application Common Extranet ScenariosLine of Business ApplicationsCollaborationStatic Content or PublishingIsolate and segregate internal data.Authorize to use only sites and data that are necessary for their contributions.Restrict partners from viewing other partners’ data.Target ContentSegment content Limit content access and search results based on audience.Remote EmployeesPartnersVendors & Customers
- 6. Extranet Design Considerations & ChallengesNetwork Topology and AccessIdentity ManagementSeamless Single Sign-on ExperienceContent Security and AccessAntivirusClientServerRich Client Experience (Office Integration)
- 7. Edge Firewall TopologyInternetCorporate NetworkExternal UsersInternalUsersSharePoint Farm
- 8. Back-to-Back Perimeter TopologyInternetCorporate NetworkPerimeterExternal UsersInternalUsersApp ServersWeb Front EndsInfrastructure Servers
- 9. Split Back-to-Back TopologyInternetCorporate NetworkPerimeterExternal UsersInternalUsersWFEAppInfraAppInfra
- 10. Security TermsAuthentication is the mechanism whereby systems may securely identify their usersCreates an identity for security principalWho am I?Authorization is the mechanism by which a system determines what level of access a particular authenticated user should have to secured resources controlled by the system.Determines what resources an identity has access toWhat can I access?
- 11. SharePoint AuthenticationSharePoint does not authenticateWindows authentication via Windows server and IIS (Kerberos/NTLM)FBA via ASP. NET and authentication providers (SQL, LDAP, etc.)Web SSO via Active Directory Federation Services (ADFS) and other Identity Management SystemsSharePoint creates user profilesSPUser object represents security principalUser Profile List in Site Collections track user profiles
- 12. SharePoint 2010 SecuritySharePoint 2010 changes authenticationUses classic mode and claims based authenticationClassic mode is SharePoint 2007 style legacy modeClaims-based authentication is the new security modelWhat are the benefits?Claims decouples SharePoint from the authentication providerAllows SharePoint to support multiple authentication providers per URLIdentities can be passed without Kerberos delegationAllows federation between organizationsACLs can be configured with DLs, Audiences and OUs
- 13. Identity NormalizationClassicClaimsNT TokenWindows IdentityNT TokenWindows IdentitySAML1.1+ADFS, etc.ASP.NET (FBA)SQL, LDAP, Custom …SAML TokenClaims Based IdentitySPUser
- 14. Claims-Based TerminologyIdentity: security principal used to configure the security policyClaim (Assertion): attribute of an identity (such as Login Name, AD Group, etc.)Issuer: trusted party that creates claimsSecurity Token: serialized set of claims (assertions) about an authenticated user.Issuing Authority: issues security tokens knowing claims desired by target application (AD, ASP.NET, LiveID, etc.) Security Token Service (STS): builds, signs and issues security tokensRelying Party: application that makes authorization decisions based on claims
- 16. Mixed Mode Authentication vs Multi-Authentication
- 18. Authentication ScenariosMixed Mode: When to Use ItDifferent scheme for different protocolsIntranet HTTPExtranet HTTPSProtecting access from different channelsPreventing employees log in from home except Sales divisionDedicate Extranet to vendors onlyPreferred choice for solutions that require separate environmentsPublishing Portal authored by employees and consumed by customers
- 20. Authentication ScenariosMulti Authentication: When to Use ItSame experience for different class of usersSingle URLSame experience for same users no matter where they access content from:A la’ Outlook Web AccessPreferred choice for cross company collaboration solutions
- 21. SharePoint 2010 Beta 2Supported at Beta2Windows-ClassicFBA-ClaimsAnonymousFBA-Claims + AnonymousNOT Ready for deployment at Beta2Windows-ClaimsSAML-ClaimsWindows-Claims + FBA-Claims
- 22. Questions
- 23. Learn More about SharePoint 2010Information forIT Prosat TechNethttp://MSSharePointITPro.comInformation forDevelopersat MSDNhttp://MSSharePointDeveloper.comInformation forEveryonehttp://SharePoint.Microsoft.com
- 25. Sources and LinksGeneva Framework A Better Approach For Building Claims-Based WCF Serviceshttp://msdn.microsoft.com/en-us/magazine/dd278426.aspxAn Introduction to Claims http://msdn.microsoft.com/en-us/library/ff359101.aspxMicrosoft SharePoint Conference 2009 http://www.mssharepointconference.com/Pages/default.aspxIdentity Management http://msdn.microsoft.com/en-us/security/aa570351.aspx
Editor's Notes
- #3: So today we are going to define an extranet and cover …
- #6: Lets look at three common network topologies …
- #11: Authentication returns the security principal in the HttpContext.UserIIS AuthenticatesFBA requires authentication providers to implement the Membership Provider interfaceWebSSO requires authentication providers to implement the Membership Provider interface including an HTTPModule for the WebSSO ProviderMembership Provider:GetUser( string )GetUserNamebyEmailFindUsersbyEmailFindUsersbyNameRole manager: RoleExists, GetRolesForUser, GetAllRolesWebSSOHTTPModule: AuthenticateRequest Uses user auth cookie to set HttpContext.User with security principalEndRequest Used to catch the 401 responses from WSS, turns them into 302 redirect for auth to the WebSSO logon server.
- #13: Classic – Windows Native (NTLM, Kerberos). SharePoint consumes the NT token into an SPUser.Claims – Windows (NTLM, Kerberos), FBA (LDAP, ASP.Net/SQL), SAML (ADFS, WSTrust, WSFederation)Claims authentication for Microsoft SharePoint Server 2010 is built on Windows Identity Foundation. Windows Identity Foundation Framework is a set of .NET Framework classes that are used to implement claims-based identity.
- #15: Client is using a web browser. The client makes a web request (HTTP GET)SharePoint responds with a 401 Unathenticated and 302 Url to authenticateThe Authentication request is submitted to, and processed by, the local STS or another SAML compliant Identity provider, such as LiveID.The identity provider validates the identity and returns the security token (NT Token/SAML Token)Does SharePoint trust the token? The SharePoint (relying party) STS finds the policy for the requesting Web application in the policy store and creates a token for the requesting user using identity assertion values in the attribute store. Token augmentation, we add additional claims. A valid security token (new SharePoint SAML token) is returned to the user and then submitted to the Web application. The Web Browser requests the SharePoint resource with the Shareoint security token. SAML token is converted into an SPUser.Note there are two different tokens: One from Identity Provider, another from SharePoint.
- #16: Mixed Mode Authentication – (MOSS 2007) Single SharePoint Web Application, extended IIS Applications with different Urls and authentication.Multi-Authentication - Single SharePoint Web Application with more than one authentication provider.
- #18: Different scheme for different protocolsProtecting access from different channelsAnonymous web sites