Planning and Configuring Extranets in SharePoint 2010

Planning and Configuring
Extranets in SharePoint 2010

 Geoff Varosky
 Jornata
 Architect, Director of Evangelism
 Co-Founder Boston Area SharePoint Users Group
 Co-Organizer SharePoint Saturday Boston
 Blog – www.SharePointYankee.com
 Email – gvarosky@jornata.com
 Twitter – @gvaro
 LinkedIn & Facebook
 Visit Jornata Booth #601

 Thinking
 What is an Extranet?
 Design
 Topology
 Authentication Mechanism
 User Identity Storage Location
 Evaluating Your Requirements
 SharePoint 2010 Considerations
 Doing
 Configuration
 User and Role Management

Controlled access from
external networks

Controlled access from
EXTeRnAl NETworks

 Topology
 Authentication Methods
 User Identity Storage Location

Corporate network
a/k/a where you access
Internets Perimeter network Facebook from every
morning

External Firewall/UAG Server Farm
Users

Internets Perimeter network Corporate network

Firewall Router A Router B Firewall
/UAG /UAG

LAYER 1 LAYER 2 LAYER 3
Web Servers APP & SQL DNS, Active Directory,
Servers LOB Systems

Internets Perimeter network Corporate network

External Firewall Firewall
Users /UAG /UAG

CONSUMING SERVICES FARM
FARM

Corporate network
Internets Perimeter network
YAY! FACEBOOKS! LOLS!

External Firewall Firewall
Users /UAG /UAG

Web Servers, SQL Servers,
Application Application
Servers, Servers,
DNS, Active DNS, Active
Directory Directory

 Windows
 NTLM
 Kerberos
 Basic
 Forms Based Authentication (FBA)*
 *Claims needs to be enabled for FBA
 Claims Based Authentication
 SAML tokens

 Active Directory
 LDAP
 SQL Server
 Other
 Facebooks
 Twitters

 What do you really need?
 Who needs access?
 How sensitive is the data?
 How sensitive is the network?
 Budget?**

 Who needs access?
 Internal employees only
 Internal employees and external users
 Additional domain with restricted access
 Active Directory & Forms Based Authentication
 Claims Authentication
 External only (rare)
 Clients, partners, consultants
 Active Directory or LDAP or SQL?
 Forms Based Authentication or Windows auth?
 Separate or together?
 Hosting
 Mobile Clients

 How sensitive is the data & internal network?
 Network & SharePoint
 Separate site?
 Separate site collection?
 Separate web application?
 Multiple farms with cross-farm services & publishing?
 Separate farm?
 DMZ?

 How sensitive is the data & internal network?
 Security
 Secure Certificates (SSL)
 Encryption
 Firewall
 Both hardware and software?
 Content Filtering
 ACLs
 Virtual Private Network
 Anti-Virus and Anti-Malware
 Client-based certificates
 One-time passwords (RSA tokens)
 Phone verification
 Biometrics
 Retina, fingerprint, facial structure, hair and blood samples

 REMEMBER THIS…

You are giving a key to
access your company’s
data in some form or
another.

 Supported versions
 All – Foundation up through Enterprise
 Office 365
 Can be used as an extranet (since that is basically what it is!)

 Assumptions
 Any Topology
 Multi-Mode (Windows & FBA Authentication)
 SQL User Database

1. Create ASP.NET Membership Database
2. Configure SharePoint
3. Configure IIS
4. Create and Manage Users

 IIS
 Using your SharePoint Site = BAD
 Must first change default role manager, and then membership provider each time from
claims to your SQL providers
 No one can log into SharePoint during this time
 And then change them back when done
 Each change recycles the application pool.
 Create a separate IIS Virtual Web Application and Manage from there

 BCS
 Great way to search for and manage users (passwords, email, etc.)
 No way to create users without additional logic

 CodePlex (www.codeplex.com)
 SharePoint 2010 FBA Pack
 http://sharepoint2010fba.codeplex.com

 Third Party Solutions

 Test your configuration
 Review security regularly
 Be wary of cats

 My Blog Series
 Part 1 : http://go.gvaro.net/ExtranetsP1
 Phone Factor – Phone Verification
 http://www.phonefactor.com
 Plan Security Hardening (TechNet)
 http://go.gvaro.net/uSyY1Z
 SharePoint 2007 & 2010 Farm Ports (Firewall Config)
 http://go.gvaro.net/uWQZzU
 Disabling SSL v2.0, PCT 1.0 +more in IIS7
 http://go.gvaro.net/N5GgEa

 SharePoint Ports, Proxies, and Protocols (Firewall Config)
 http://go.gvaro.net/tblxCn
 Harden SQL Server for SharePoint
 http://go.gvaro.net/viVQuN
 Visual FBA configuration by Donal Conlon
 http://go.gvaro.net/oPnAYx
 Extranet tested topologies for SP 2010 Model
 http://go.gvaro.net/SP2010ExtTopMod
 ASP.NET 2.0 Membership Database Reference
 Create, Add Users, etc. http://go.gvaro.net/AN2Mbr

 FBA Configuration in SharePoint 2010
 LDAP: http://go.gvaro.net/FBALDAP
 ASP.NET Membership DB
 http://go.gvaro.net/FBAANMDB
 PeoplePicker Wildcard Search
 http://go.gvaro.net/FBAWildCard
 Helpful Resources for Troubleshooting Membership Providers
 http://go.gvaro.net/TSMemProv
 “Sign me in automatically” in FBA
 http://go.gvaro.net/pAkDQP
 Configuring SSL in a Development Environment
 http://go.gvaro.net/uOTTlJ

 Meets 2nd Wednesday/month
 6-8PM
 Microsoft N.E.R.D. (Cambridge)
 BostonSharePointUG.org
 Twitter: @BASPUG / #BASPUG

 MEETING TONIGHT HERE! 7P-9P
 Staffordshire room
 Ask the experts panel!

Planning and Configuring Extranets in SharePoint 2010

More Related Content

What's hot (13)

Similar to Planning and Configuring Extranets in SharePoint 2010 (20)

More from Geoff Varosky (12)

Recently uploaded (20)

Planning and Configuring Extranets in SharePoint 2010