Planning and Configuring Extranets in SharePoint 2010 by Geoff Varosky - SPTechCon

Planning and Configuring
Extranets in SharePoint 2010

 Geoff Varosky
 Jornata
 Managing Consultant, Senior Architect, Senior Developer, Director of
Evangelism
 President & Co-Founder Boston Area SharePoint Users Group
 Co-Organizer SharePoint Saturday Boston
 Recent Awards
 Top 25 2012 Harmon.ie Online Community Influencer
 Top 50 2012 KnowledgeLake Community Influencer
 Blog – www.SharePointYankee.com
 Email – geoff@varosky.com
 Twitter – @gvaro

 Thinking
 What is an Extranet?
 Design
 Topology
 Authentication Mechanism
 User Identity Storage Location
 Evaluating Your Requirements
 SharePoint 2010 Considerations
 Doing
 Configuration
 User and Role Management

Controlled access from
external networks

Controlled access from
EXTeRnAl NETworks

 Topology
 Authentication Methods
 User Identity Storage Location

Corporate network
a/k/a where you access
Internets Perimeter network Facebook from every
morning

External Firewall/UAG Server Farm
Users

Internets Perimeter network Corporate network

Firewall Router A Router B Firewall
/UAG /UAG

LAYER 1 LAYER 2 LAYER 3
Web Servers APP & SQL DNS, Active Directory,
Servers LOB Systems

Internets Perimeter network Corporate network

External Firewall Firewall
Users /UAG /UAG

CONSUMING SERVICES FARM
FARM

Corporate network
Internets Perimeter network
YAY! FACEBOOKS! LOLS!

External Firewall Firewall
Users /UAG /UAG

Web Servers, SQL Servers,
Application Application
Servers, Servers,
DNS, Active DNS, Active
Directory Directory

 Windows
 NTLM
 Kerberos
 Basic
 Forms Based Authentication (FBA)*
 *Claims needs to be enabled for FBA
 Claims Based Authentication
 SAML tokens

 Active Directory
 LDAP
 SQL Server
 Other
 Facebooks
 Twitters

 What do you really need?
 Who needs access?
 How sensitive is the data?
 How sensitive is the network?
 Budget?**

 Who needs access?
 Internal employees only
 Internal employees and external users
 Additional domain with restricted access
 Active Directory & Forms Based Authentication
 Claims Authentication
 External only (rare)
 Clients, partners, consultants
 Active Directory or LDAP or SQL?
 Forms Based Authentication or Windows auth?
 Separate or together?
 Hosting
 Mobile Clients

 How sensitive is the data & internal network?
 Network & SharePoint
 Separate site?
 Separate site collection?
 Separate web application?
 Multiple farms with cross-farm services & publishing?
 Separate farm?
 DMZ?

 How sensitive is the data & internal network?
 Security
 Secure Certificates (SSL)
 Encryption
 Firewall
 Both hardware and software?
 Content Filtering
 ACLs
 Virtual Private Network
 Anti-Virus and Anti-Malware
 Client-based certificates
 One-time passwords (RSA tokens)
 Phone verification
 Biometrics
 Retina, fingerprint, facial structure, hair and blood samples

 REMEMBER THIS…

You are giving a key to
access your company’s
data in some form or
another.

 Supported versions
 All – Foundation up through Enterprise
 Office 365
 Can be used as an extranet (since that is basically what it is!)

 Assumptions
 Any Topology
 Multi-Mode (Windows & FBA Authentication)
 SQL User Database

1. Create ASP.NET Membership Database
2. Configure SharePoint
3. Configure IIS
4. Create and Manage Users

 IIS
 Using your SharePoint Site = BAD
 Must first change default role manager, and then membership provider each time from
claims to your SQL providers
 No one can log into SharePoint during this time
 And then change them back when done
 Each change recycles the application pool.
 Create a separate IIS Virtual Web Application and Manage from there

 BCS
 Great way to search for and manage users (passwords, email, etc.)
 No way to create users without additional logic

 CodePlex (www.codeplex.com)
 SharePoint 2010 FBA Pack
 http://sharepoint2010fba.codeplex.com

 Third Party Solutions

 Test your configuration
 Review security regularly
 Be wary of cats

 My Blog Series
 Part 1 : http://go.gvaro.net/ExtranetsP1
 Phone Factor – Phone Verification
 http://www.phonefactor.com
 Plan Security Hardening (TechNet)
 http://go.gvaro.net/uSyY1Z
 SharePoint 2007 & 2010 Farm Ports (Firewall Config)
 http://go.gvaro.net/uWQZzU
 Disabling SSL v2.0, PCT 1.0 +more in IIS7
 http://go.gvaro.net/N5GgEa

 SharePoint Ports, Proxies, and Protocols (Firewall Config)
 http://go.gvaro.net/tblxCn
 Harden SQL Server for SharePoint
 http://go.gvaro.net/viVQuN
 Visual FBA configuration by Donal Conlon
 http://go.gvaro.net/oPnAYx
 Extranet tested topologies for SP 2010 Model
 http://go.gvaro.net/SP2010ExtTopMod
 ASP.NET 2.0 Membership Database Reference
 Create, Add Users, etc. http://go.gvaro.net/AN2Mbr

 FBA Configuration in SharePoint 2010
 LDAP: http://go.gvaro.net/FBALDAP
 ASP.NET Membership DB
 http://go.gvaro.net/FBAANMDB
 PeoplePicker Wildcard Search
 http://go.gvaro.net/FBAWildCard
 Helpful Resources for Troubleshooting Membership Providers
 http://go.gvaro.net/TSMemProv
 “Sign me in automatically” in FBA
 http://go.gvaro.net/pAkDQP
 Configuring SSL in a Development Environment
 http://go.gvaro.net/uOTTlJ

 Meets 2nd Wednesday/month
 6-8PM
 Microsoft N.E.R.D. (Cambridge)
 BostonSharePointUG.org
 Twitter: @BASPUG / #BASPUG
 SPTechCon Hosted Meeting in August!

Planning and Configuring Extranets in SharePoint 2010 by Geoff Varosky - SPTechCon

More Related Content

What's hot (20)

Viewers also liked (7)

Similar to Planning and Configuring Extranets in SharePoint 2010 by Geoff Varosky - SPTechCon (20)

More from SPTechCon (20)

Planning and Configuring Extranets in SharePoint 2010 by Geoff Varosky - SPTechCon

Editor's Notes