Designing a Secure Extranet with Sharepoint Russ Basiura Principal Consultant RJB Technical Consulting Extranets

Agenda Deployment Scenario Configuration Challenges Security and Authentication

Scenario

Active Directory in the DMZ –No Trusts Single Server or small farm –All servers in the DMZ All Services in the DMZ –Mail –IM Basic Authentication over HTTPS Digest Authentication (Not Supported)

Scenario All Users must logon Management via Remote Desktop All content stored in portal Ports –TCP 3389 open to intranet for RDP –TCP 80 open to intranet for HTTP –TCP 443 open to extranet for HTTPS

User Challenges Authentication –Users don’t like being asked for identity –Use Portal SSO to access other resources URLS –Store content on the portal –Put content links on the portal

Technical Challenges Authentication SSL

Authentication Basic over https Integrated –NTLM –Kerberos Digest –Single web server or web farm with affinity –Not Supported Custom –ISAPI Filter with persistent cookie –Not Supported

Custom Authentication Must create a valid Windows Principal Must attach context to thread before entering.Net pipeline –Ows.dll is an ISAPI extension –ISAPI extensions cannot be chained Build an ISAPI filter –Create and manage Windows Principal –Embed basic authentication headers in request

Discussion