HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access

This article was been updated for WSS v3 / MOSS 2007 RTM on December 11, 2006. In addition, additional information was added and changed in the section Enabling Anonymous Access when the article was updated for RTM.

Content-centric sites that are managed via a Content Management System typically have very specific requirements. The owners of the content of a content-centric site usually spend most of their time behind the company firewall and login to their corporate Active Directory. Ideally these users need to have a single-sign-on (SSO) experience where they don't have to remember a special username and password to simply login to a Content Management System to author and manage the content on the company Web site. The public-facing portion of the site needs to allow visitors to browse the site anonymously. However, there may be certain areas of the site that require the user to login. These may include premium content, registration, or an e-commerce solution. While the familiar username/password dialog is acceptable in a corporate setting, it is frowned upon on the public realm of the Internet. Therefore, many companies prefer to implement some type of forms authentication where users login using a username or email address and password to gain access to protected areas.

Web Content Management (WCM), one piece in the Enterprise Content Management (ECM) strategy included in Microsoft Office SharePoint Server (MOSS) 2007 adds the capability of hosting and managing content-centric sites to the SharePoint platform. MOSS 2007 is built on top of Windows SharePoint Services (WSS) v3 which is in turn built on top of ASP.NET 2.0. This means that WSS v3 (and MOSS 2007) have full access and utilize everything that ASP.NET 2.0 has to offer… including the pluggable authentication model. It is this pluggable authentication that I will leverage to provide multiple authentication options for a single Web site. In this article I want to demonstrate how to configure a Publishing Site (aka: WCM site) in MOSS 2007 for the previously described common scenario companies encounter with content-centric sites. The goal is to provide an experience that achieves three requirements:

Allow content owners/authors to authenticate on the site using their corporate Active Directory credentials in order to manage the Web site's content.
Allow unauthenticated, anonymous users, to browse the unrestricted areas of the Web site.
Require anonymous user to provide a friendly Web-based form to login in order to consume restricted content.

I'll demonstrate how all three goals can be achieved using MOSS 2007 and WSS v3 in this article. First I'll set up a database to store the information for users accessing the Web site from the Internet. Once that's configured, I'll create two Web applications and a Publishing Site; each Web application, or IIS Web site, will be configured for a specific type of authentication mechanism (Windows Authentication [AD] and Forms Authentication). Then I'll configure both Web applications so they can access the users and roles that will be granted rights within the site (typically read or contribute rights to protected areas of the site). Once both sites are configured to communicate with the forms authentication-based user and role store, I'll configure one Web application to allow users to sign-in and authenticate via a common Web-based form. The last step will be to configure the site for anonymous access so they can browse the site and consume the content. Finally, I'll show you how to require a login for a specific area of the site.

This article is not written as a step-by-step instruction manual on how to configure your site for anonymous access with dual authentication mechanisms. It assumes some experience with WSS v3 and MOSS 2007. While the subject of this article deals with configuring a Publishing Site (aka: Web Content Management Site), everything translates to any type of WSS v3-based site including MOSS sites.

Setting Up ASP.NET 2.0 Forms Authentication User & Role Data Store

Before we can do anything, we first need to create a database that will store all the information, credentials, roles, and users for the forms based authentication site. Then we'll add a single user to this database which we'll use for testing later. Nothing in this step has anything to do with SharePoint as its just plain ASP.NET 2.0.

Create the ASP.NET 2.0 Database

Before we can do anything else, we need to create a database that will store the users and roles. Microsoft has provided a utility, aspnet_regsql.exe, that will create this database for you. It can be found here: %windir%\Microsoft.NET\Framework\v2.0.5027. Executing this file will trigger a wizard that will walk you through creating the ASP.NET 2.0 database. I've named my database AcAspNetDb and configured it for Windows Authentication, as shown in Figure 1 below.

Figure 1 – aspnet_regsql.exe wizard (click for larger image)

Configure Membership & Role Providers

Now that our database is configured, we need to add a single user. In my opinion, the best way to do this is to create a new Web site project in Visual Studio 2005. Why? Because not only does it have an easy way to access the ASP.NET 2.0 administration Web site that will let us add users and roles, but we'll also ensure our database connection strings, membership, and role providers are correctly configured before we bring SharePoint into the equation. I'll use these same connection string and providers in the SharePoint sites later… so we have a good foundation to copy from.

Open Visual Studio 2005 and select File -> New -> Web Site. In the New Web Site dialog, select the template ASP.NET Web Site, set the location to File System. I like to put all my Web sites in the [drive]:\Inetpub directory so I'll put mine in the following directory: [drive]:\Inetpub\AC FBA Utility Site (FBA = Forms Based Authentication). The language is irrelevant so you can pick anything… we won't write a single line of code.

Figure 2 – Visual Studio 2005 New Web Site dialog

Now, add a web.config file to the site. By default, you'll see a <connectionStrings /> node within the <configuration> node. Here you want to specify a connection string to the database you just created in the previous step. For me, I'll replace the node with the following:

   1:  <connectionStrings>

   2:      <add name="AcSqlConnString"

   3:          connectionString="server=[YourSqlServerName];database=AcAspNetDB;
				Integrated Security=SSPI;"

   4:          providerName="System.Data.SqlClient"

   5:      />

   6:  </connectionStrings>

With the connection string set up, now we need to specify the membership and role providers. In this article I'm using the ASP.NET SQL membership and role providers, so I need to add the following to the web.config file, within the <system.web> node:

   1:  <!-- membership provider -->

   2:  <membership defaultProvider="AcAspNetSqlMembershipProvider">

   3:      <providers>

   4:          <add name="AcAspNetSqlMembershipProvider"

   5:              type="System.Web.Security.SqlMembershipProvider, System.Web, 
			Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

   6:              connectionStringName="AcSqlConnString"

   7:              enablePasswordRetrieval="false"

   8:              enablePasswordReset="true"

   9:              requiresQuestionAndAnswer="false"

  10:              applicationName="/"

  11:              requiresUniqueEmail="false"

  12:              passwordFormat="Hashed"

  13:              maxInvalidPasswordAttempts="5"

  14:              minRequiredPasswordLength="1"

  15:              minRequiredNonalphanumericCharacters="0"

  16:              passwordAttemptWindow="10"

  17:              passwordStrengthRegularExpression=""

  18:          />

  19:      </providers>

  20:  </membership>

21:

  22:  <!-- role provider -->

  23:  <roleManager enabled="true" defaultProvider="AcAspNetSqlRoleProvider">

  24:      <providers>

  25:          <add name="AcAspNetSqlRoleProvider"

  26:              type="System.Web.Security.SqlRoleProvider, System.Web, 
			Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

  27:              connectionStringName="AcSqlConnString"

  28:              applicationName="/"

  29:          />

  30:      </providers>

  31:  </roleManager>

There are a few things you should take note of from the above code (marked in bold). First, note the name and connectionString attribute for the providers. When you install the .NET Framework 2.0, default connection strings and providers are specified in the machine.config file (located in the %windir%\Microsoft.NET\Framework\v2.0.5027\CONFIG). You want to make sure you use unique names here and not the names that Microsoft has included as the default names in the machine.config file. If you elect to reuse their names, you'll need to explicitly remove each one by name (via the <remove /> node) or clear all predefined connection strings and providers (via the <clear /> node). To make it easy, I specified unique names, as indicated in bold.

With everything configured, launch the ASP.NET 2.0 Web administration site from within Visual Studio 2005: Website -> ASP.NET Configuration. When the site loads, the first order of business is to switch it from Integrated Authentication to Forms Authentication. To do this, select the Security link and then select the Select Authentication Type link in the Users container. If it isn't selected already, make sure From The Internet (aka: Forms Authentication) is selected and click Done.

Create A User

Next, we need to add a user that we'll later use for testing. Select Security again and then select Create User. I'm going to create a new user with the User Name of andrewconnell and Password of password. Note I don't have to enter a strong password because of some of the settings I changed in the membership provider in the code above. The E-mail address isn't important, so I'll just enter andrewconnell@foo.com and click Create User.

Finally, let's make sure the markup in our web.config file is correct for our membership and role provider. To do this, select the Provider tab and then select Select a Different Provider For Each Feature (Advanced). You should see the membership and role provider that we specified in our web.config. Selecting the Test link for either should confirm they are successfully talking to the database.

At this point, we now have our ASP.NET 2.0 user and role database store configured. More importantly we should have a good template web.config containing the connection string, membership provider and role provider settings that we can copy from when modifying the web.config files for our SharePoint sites. Now we need some Web applications to configure!

Creating Two Web Applications, One For Each Authentication Mechanism

We need some sites to configure for authentication right? I mean, that's the point of the article right? Duh!

Creating the http://extranet IIS Web site

First step is to create a new Web application just like you would any other time. From SharePoint's Central Administration Web site, select the Application Management tab, then Create or Extend Web Application and then Create a New Web Application. I'm guessing if you're reading this article, you know how to create a new Web application from here… so I'll spare the details, but I want to point out is that I specified the following:

Set the Description as SharePoint – Extranet 80
Set the Port to 80
Set the Host Header to extranet
Picked NTLM as the Authentication Provider
Specified Anonymous Access to No

After creating the Web application, I then created a new site collection in the Web application naming the site Acme and picking the Publishing Portal site template. If you're having problems and want to see exactly what I selected, you can view Figure 3 displaying the Create New Web Application page or Figure 4 displaying the Create Site Collection page.

At this point we now have a site, configured for Windows Authentication, named ACME at http://extranet. This is the site our content owners will use to authenticate using their Active Directory corporate accounts in order to add, edit, and manage the content on our Publishing site. Make sure everything is working by browsing to the http://extranet Acme site. You should see the Welcome control and the Site Actions menu in the upper right-hand corner of the page. Assuming everything is working, we have now satisfied the first goal listed in the introduction above!

Creating the http://internet IIS Web site

Now we need to extend our Web application to another IIS Web site. This is the site our anonymous, or Internet users, will use to access the site. This site will need to be available to anonymous users as well as provide a mechanism for them to authenticate against, via Forms Authentication, in order to access restricted areas of the site (such as a member's only section). To extend the Acme Web application to another IIS Web site, from SharePoint's Central Administration, select the Application Management tab, then Create or Extend Web Application and then Extend an Existing Web Application. Again, I'll spare you from the details and highlight only a few important points on this page:

Make sure you select the Web application you want to extend… in our case we want SharePoint – Extranet 80. Use the Web Application selector at the top of the page to pick the correct application.
Set the Description as SharePoint – Internet 80
Set the Port to 80
Set the Host Header to internet
Picked NTLM as the Authentication Provider
Specified Anonymous Access to No
Set the Load Balanced URL Zone to Internet

We'll enable anonymous access later.

Again, if you are having problems, you can see exactly what I selected from Figure 5. Now we have a site that we can configure for our Internet users to access anonymously and also login via Forms Authentication. However, before we do that, there are a few configuration tasks we have to do.

Configure The Web Applications To Communicate With The ASP.NET 2.0 Forms Authentication Data Store

Once you have a Web application created that will host a site, you will need to change its authentication provider to not use Windows Authentication but instead use Forms Authentication as well as configure the site so it can communicate with our user and role data store… the AcAspNetDb we created earlier. To do this, we'll use the connection string, membership provider, and role provider we created and already tested in our utility Web site's web.config file.

Configure http://extranet & http://internet

First, we'll modify the two IIS Web sites (http://extranet and http://internet) web.config files to include the connection string, membership provider, and role provider information so they can both communicate with our user and role store. It's obvious why the http://internet site would need these changes, but why make them to the http://extranet site when we're going to use it for Forms authentication? If we didn't, it would be somewhat difficult and inconvenient (but not impossible) when we needed to grant any special permissions in the Acme Web application to one of the users or roles in our data store. This way, one of our content owners can authenticate using his/her Active Directory credentials and still grant a user who will authenticate via Forms Authentication access within the site.

Open the web.config file for the http://extranet Web site, found in the following directory (if you let SharePoint specify the Web site root directory... otherwise, retrieve it from your specified path): c:\Inetpub\wwwroot\wss\VirtualDirectories\extranet80. Add the <connectionStrings> node, listed above, just after the closing </SharePoint> tag and opening <system.web> tag. Then add the membership and role provider markup, listed above, just after the opening <system.web> tag and save your changes. Do the same thing for the web.config for the http://internet Web site, found here: c:\Inetpub\wwwroot\wss\VirtualDirectories\internet80.

Configure SharePoint Central Administration

Now both Web applications are configured to communicate with the data store. There's one last step we have to do… we need to add the same information to the SharePoint's Central Administration Web site's web.config file. Why? We need to make sure the Central Administration Web site can communicate with the data store in case we want to do any security management of the users and roles in the data store such as configuring policies for the Web application. Repeat the steps above for the Central Administration's web.config which should be found here: c:\Inetpub\wwwroot\wss\VirtualDirectories\[#####]. You need to make one small change… change the defaultProvider attribute on the <roleManager> node to AspNetWindowsTokenRoleProvider. This is necessary because Central Administration still uses Windows Authentication for the role provider. The <roleManager> node for the Central Administration's web.config should look like this:

   1:  <!-- role provider -->

   2:  <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider">

   3:      <providers>

   4:          <add name="AcAspNetSqlRoleProvider"

   5:              type="System.Web.Security.SqlRoleProvider, System.Web, 
			Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

   6:              connectionStringName="AcSqlConnString"

   7:              applicationName="/"

   8:          />

   9:      </providers>

  10:  </roleManager>

Now we're finally ready to configure the http://internet site for Forms Authentication!

Enabling Forms Authentication On One Web Application

Flipping the switch to Forms Authentication is very simple… it's just all the prep work that's the complicated part. Browse to SharePoint's Central Administration Web site, select the Application Management tab, and then select Authentication Providers. First, ensure you are working with the correct Web application by checking the selector in the upper right-hand corner of the Authentication Providers page (as shown in Figure 6). Once you're on the correct Web application, select the Internet zone link (as shown in Figure 6).

Figure 6 – Authentication Providers page

Note that even though we've selected the http://extranet Web application, we are really modifying the http://internet IIS Web site because that's the one mapped to the Internet zone.

On the Edit Authentication page, we are going to change the Internet zone for the http://extranet Web application to the following settings:

Authentication Type: Forms
Enable Anonymous Access: checked
Membership Provider Name: AcAspNetSqlMembershipProvider
Role Manager Name: AcAspNetSqlRoleProvider

Notice that the names of the Membership Provider Name and Role Manager Name are the names of the providers we entered in the web.config's. Now you see why we had some pre-configuration work to do before we actually made the switch. Refer to Figure 7 to see all settings I selected on the Edit Authentication page.

We now have two different ways for users to get to our Acme Web application:

Via http://extranet, authenticating using Windows Authentication (using their Active Directory credentials)
Via http://internet, anonymously or authenticating using Forms Authentication

Ah.. but we're not quite finished. Even though the http://internet Web site is now configured to allow anonymous users, the Acme Web application has not been set to grant permission for anonymous users to browse the site. You can prove this by trying to browse to http://internet. You'll immediately get redirected to the default SharePoint Forms Authentication Sign In page, as shown in Figure 8.

Figure 8 – SharePoint's default Forms Authentication Sign In Page

Let's prove that the Forms Authentication is actually working with our data store. First we need to add our user to the site. To do this, browse to the http://extranet Web site, select Site Actions, then Site Settings, then People And Groups. Select the New button to add a user to the site. On the Add Users: Acme page, enter the username of the user we created previously: andrewconnell. Then click the Check Names icon (little icon with a blue check just below the Users/Groups input box… or press [CTRL]+[K]). In the Give Permission section, select Add Users To A SharePoint Group and select Acme Visitors [Read] and finally click OK. We've now granted our user access to the site.

To test, open a new browser window and browse to http://internet. You should immediately get sent to the SharePoint Sign In page. Enter the account's credentials (andrewconnell/password) and click Sign In. You'll then get signed in and redirected back to the homepage of the site. You can see you're logged in because you can now see the Welcome control in the upper right-hand corner of the site. Notice how you can't see the Site Actions menu? That's because we only have the rights assigned to Visitors, which means we can't do anything to the site but browse it.

Last step… let's open the site up for anonymous users…

Enabling Anonymous Access

In order for anonymous users to have access to the Acme Web application and browse the site, we need to turn anonymous access on. In our case though, we only want to turn anonymous access on for the external (or http://internet) site. Before we do this, we should create a new account in our ASP.NET 2.0 database that we can use as an administrative account to make changes to our external site. First, create a new account using the same process in the Setting Up ASP.NET 2.0 Forms Authentication User & Role Data Store: Create A User section above. I'm going to create this account with the following credentials:

Username: FbaAdmninistrator
Password: password

Next, we need to grant this user ownership-level rights to our http://internet site. WSS v3 introduces a new capability where we can specify a user to have full control over a site via Web Application policies. These policies trump any permission setting within the site itself. We'll use this to set a policy to grant the FbaAdministrator full control over our http://internet site. Browse to Central Administration, select the Application Management tab, then Policy for Web application under the Application Security section. Make sure you've selected the correct Web Application from the selector in the upper-right corner of the page (in our case, we want to select http://extranet). Next, select Add Users from the toolbar. On the Add Users page, select the Internet zone (because this is the zone we specified for our http://internet Web Application) and click Next. Finally, enter the user FbaAdministrator in the Choose Users step, select Full Control in the Choose Permissions step, and click Finish. Now you can login to the http://internet site and have full control over the site, just like the site owners have.

Now we can setup anonymous access for our http://internet site. To do this, browse to the http://internet Web site, login using the FbaAdministrator account we just created and configured, select Site Actions, then Site Settings, then Modify All Site Settings. On the Site Settings page, select Advanced Permissions. On the Permissions: Acme page, select Settings, and then select Anonymous Access (see Figure 9). On the Change Anonymous Access Settings: Acme page, select Entire Web Site and click Ok.

Figure 9 – Anonymous Access menu option on the Permissions Settings menu

To test, open a new browser window and browse to http://internet. You should go straight to the Web site as an anonymous user! You can tell you aren't signed in because there's a Sign In link in the upper right-hand corner of the site where the Welcome control usually is. We have now satisfied the second goal listed in the introduction above!

Configuring A Section Of the Site For Authenticated Users Only

Our last goal was to configure a section of the site so that users must be authenticated to have access to that section's, or site's, content. To do this, we'll have to go back into our site as through the http://extranet. Because the site is now set up for anonymous access, you won't automatically be signed in, so you'll have to click the Sign In link in the upper right-hand corner. Because we created the site using the Publishing Portal template, there's a subsite named Press Releases in our site collection.

Let's make it so this site requires the user to login. Select Site Actions and then Manage Content and Structure. On the Site Content and Structure page, select Press Releases from the left-hand navigation tree and then select Advanced Permissions (see Figure 10).

Figure 10 – Press Releases Advanced Permissions

Next, we'll break the permission inheritance with the parent site and then remove anonymous access to the Press Releases site. First, select Actions and then Edit Permissions. You'll be prompted to accept your changes… select OK. Next, Select Settings, then Anonymous Access, then on the Change Anonymous Access Settings page, select Nothing and click OK.

Now let's test it… open a new browser window and navigate to http://internet. Notice how the Press Releases section isn't on the horizontal navigation (see Figure 11)? Now sign in using the Sign In link in the upper right-hand corner and watch how the Press Releases section now appears since we're authenticated (see Figure 12)! We have now satisfied the third goal listed in the introduction above!

Figure 11 – Unauthenticated User With Press Releases Site Hidden

Figure 12 – Authenticated User With Press Releases Site Visible

Conclusion

In this article I have demonstrated how you can create a Publishing Site in MOSS 2007 and configure it for two types of authentication and at the same time allow anonymous users to browse the site. So where would you go from here? Some possible next steps would include creating a self-registration system for users to create their own accounts and have these accounts automatically registered on the site under a specific role so no additional management action is required by the site owners.

[Update 3/28/2007]: Make sure you check out Tony Starr's post on the Sharepoint Team Blog (part 1 & part 2). Also, as you can see from the comments on this post, many people think MySites are broken when you use FBA. Dan Attis has a great write up on how to get MySites working with FBA here. Make sure you check it out (part 1 & part 2). The issue deals with the fact you probably don't have a profile provider setup.

[Update 5/1/2008 @ 730a]: I now have a Visual How To screencast on MSDN that demonstrates this same process: http://msdn2.microsoft.com/en-us/library/cc441429.aspx

posted on Saturday, October 21, 2006 1:11 PM

Feedback

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/29/2007 11:19 PM Kevin Tunis

Andrew,
I just read your article HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access. I have a question, I have already created an internet facing site but I have specified the Anonymous Access to ‘yes’. I have also set this to a domain using a host header. Can we configure this site going forward using the steps in your article or should we start over?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/29/2007 11:33 PM AC [MVP MCMS]

Kevin - The steps I outlined above are generally not critical to follow in order. there are some steps that are precursors to others (such as modifying the web.config to add the providers before you specify the zone to use a specific provider). You should be able to move forward fom where you are, just note that your steps may not be identical to the ones I've outlined in my article.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/30/2007 12:35 PM Lee

Hi,

It works great except for one thing: it would be nice if users did not have to be added to the sql db before adding as a sharepoint user. Could you recommend an approach that I could use to implement this? Thanks a lot.

---------> Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/1/2007 12:45 PM Jeff Fane

Hi Andrew, First up thanks for an excellent article and a great set of interesting posts.

Couple small things:

1) Possibly the initial article had a mention of setting up host headers in DNS and local HOSTS file, however as a few people seem to be having difficulties with this (as I was) go and have a look at:

http://thesource.ofallevil.com/technet/prodtechnol/WindowsServer2003/Library/IIS/883a9544-3f70-4d46-a6df-bbadbd1fe7de.mspx?mfr=true
(gotta love the thesource.ofallevil.com :-)

2) Your article is highly regarded and mentioned by Chandima Kulathilake, Zachary Smith of Provoke Solutions in NZ who seem to be putting together an open source WSP for self-service registration...need to read more but looks and sounds great and a natural progression from here:

http://www.codeplex.com/MOSSFormsFeature/Release/ProjectReleases.aspx?ReleaseId=1702

Anyway have subscribed to your blog thanks again great article!

Cheers

Jeff Fane

PS the font is a little small even with the IE accessability features :-)

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 10/25/2006 12:01 PM josh meyer

Great article, can't wait to try this out! Thanks Andrew!

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 10/31/2006 5:21 PM Jane

wow.... this post is so much.... information and detail!
Have you tried using host header with SSL yet?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/1/2006 12:08 AM AC [MVP MCMS]

Jane - No, I haven't tried it with a HH and SSL. At this point, what you see is what you get.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/2/2006 10:44 AM Teemu

Thanks, this was really helpful!!!

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/8/2006 8:44 AM Jespre

I have not tested this yet, but what happens to the my site functionality of the forms authenticated users vs the AD users.
Currently my forms authenticated useres have no mysite functionality, and i cannot figure out what to do

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/9/2006 3:14 PM Vinod

Cool One. I was looking for this for a while....Thanks Adny

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/13/2006 9:59 AM Kevin

Ok......it's very good and very handy. Thing is, I want to give my users accessing by Forms authentication their own mysites.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/13/2006 3:43 PM AC [MVP MCMS]

Jespre - FBA should not impact MySites at all... no more than Windows authentication would... that's the beauty of the pluggable authentication model!

Kevin - That's fine... shouldn't be anything stopping you providing MySites with FBA.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/14/2006 12:07 AM Mike

Great article!!
How can I extend the intranet site to Intrenet zone on a DMZ server? Is it possible to extend a intranet site on a different server to public users and have forms authentication for internal users to access it without connecting to company network and import the AD logins to SQL database?

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/14/2006 9:20 AM Thomas

Thank you for this very detailed and useful posting (as always ;o). I think there is a typo that might be important: In the section "Creating the http://extranet IIS Web site" you list "Anonymous access = yes", but figure 3 (the picture) displays this checkbox unchecked. Now, I've configured according to the figure (unchecked anon.acc.) and cannot seem to get anonymous access to work. My SQL/Forms auth. user is directed to the login page, no matter what I try. Logging in works fine as does everything else, so I'm wondering if that setting cannot be changed after the web app has been created? (I'm running B2TR...)

Any ideas?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/14/2006 10:08 AM AC [MVP MCMS]

Mike - Hmm... not sure, this is more of an administrative question and I'm not familiar with it. I'll do some research and repost.

Thomas - Thanks! That the image is correct... it should be anon access = no. I've updated the article. If you want to enable anymous access, then the following three things must be true: (1) the Web Application [in IIS] must permit anonymous access, (2) the site must have anonymous access turned on and the site must be available to anonymous users, and (3) to set #2, you must have a way to get on the site and enable anonymous access. Remember, when you turn on anonymous access for the default zone, you are ONLY turning it on for that site... not for the Internet zone. To turn it on, you need to grant a FBA user owner rights on the site, make sure the Internet zone allows anonymous acces (which it should if you followed the instructions in the article) and then you need to turn anonymous access on.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 11:13 AM Thomas

Thank for replying. I've started over, following your article as closely as possible, and everything works, except for having anonymous access to the Internet-zone - I still get the login screen. I have a few differences from your article: 1) I'm using the "Collaboration Portal" template for the site collection. 2) Since I don't have access to DNS, I've added the two "internet"/"extranet" to my hosts-file and then use the host headers, as you prescribe (I can browse the two sites fine this way).

Some other things I've noticed along the way:
A) There's no "test" link in my ASP .NET Configuration website (actually, there is.. but it's for the default providers, not my custom one). However, since I _can_ authenticate and lookup users, I'm sure I have the connection to the FBA DB right.
B) In the section "Enabling Anonymous Access", you start by enabling anonymous access by browsing to the http://extranet site. However, since the default zone has never been setup to allow anonymous access, the option does not appear in the site settings. I think it should be http://internet you must browse to, and then have a user with Site Owner rights to enable anon.acc. for the site - as you described in your first reply to me above. Or am I completely off the mark??!

I will dig a bit more and see if I can spot anything else, but for now, this is my status! (almost there, but no cigar!)

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 9:18 PM Wilson

Hi,

Thanks and it's a great article.

I have done everything that you mentioned but I still having problem with anonymous access.

If I used Windows Authentication Type, I have no problem accessing the site anonymously.

However, once I switch it to Forms Authentication type, it always direct me to the login page. I have checked the following:
- Authentication Provider - enable anonymous access
- IIS - Enable anonymous
- Internete Site - enable anonymous access to entire site.

I have also tried granting Everyone access to the Virtual folder but it still the same.

Any ideas?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 10:42 PM AC [MVP MCMS]

Wilson - Have you actually gone into the site and turned anonymous access on? You need it not only for the Web App, the auth provider, and the zone, but also the site needs to be configured to allow anonymous access, just like the article describes.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 11:38 PM Wilson

Thanks Andrew.

Yes, I did turn anonymous access on thru "Advanced Permissions". But still the same...

I just read the comments from here:
http://blogs.msdn.com/sharepoint/archive/2006/08/16/configuring-multiple-authentication-providers-for-sharepoint-2007.aspx

Looks like a number of people have the same problem and someone mentioned that this is a known bug in B2TR...

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/16/2006 12:16 AM AC [MVP MCMS]

Wilson - Interesting... I guess we'll have to just test it after the RTM is available.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/16/2006 4:55 PM John Way

When I create the extranet website according to your instructions, I get an Under Construction page with the message "The site you are trying to view does not currently have a default page. It may be in the process of being upgraded and configured.
Please try this site again later. If you still experience the problem, try contacting the Web site administrator. "

Any ideas as to why I am getting this? If I leave out the host header value (extranet) then it creates the site fine.

Thanks,

John

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/16/2006 5:23 PM AC [MVP MCMS]

John - Sounds like you didn't add an entry in DNS or to your host file for the two sites. You have to have a way for your browser to find the sites... the easiest way is to use a host file... but that's only viable in a development environment.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/24/2006 5:49 AM Maciej R.

This is great article and everything is working just fine but I can't figure out how to integrate shared services (search and my sites) with the portal created as extranet (classic AD auth) and internet (forms sql auth).

Do you have any Ideha how I should apporach such task?

Best Regards
Maciej

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/28/2006 5:46 PM Matt Wolf

Thanks for the Great Article!

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/4/2006 6:56 AM Share Pointer

Fantastic!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/11/2006 2:07 PM AC [MVP MCMS]

I just updated the article for RTM (changing only a few things) as well as adding additional information to the Enabling Anonymous Access section.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/12/2006 10:30 AM Kent

I´m a newbee to Sharepoint but so far I like what I see.
I have been searching through Internet all day for exactly what you write here - I have find a lot of articles but yours is outstanding - THANKS!
I havent tried it yet (i havent installed MOSS yet :)) so maybee this questions I answered buy itself - as I understand your solution could have anon, form login and AD users - but if the user already is logged in to the AD - will they be prompted fo login to the MOSS also?
nd anothe newbee question - If I place the MOSS in DMZ - what will be needed to be opend for the internal net to allow AD auth?
For the form login - is it possible to access any SQL user database? We have about 3000 users in our CRM system (that is MS SQL based) - could use that database intstead of the solution you suggest above?

TIA / Kent

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/12/2006 11:33 AM AC [MVP MCMS]

Kent -
First, read the article... some questions are answered (like prompting for both FBA and AD credentials... you setup two paths so they will never get both prompts, only one).

Second, nothing specific is requred for MOSS to get your users to authenticate against an internal AD from your DMZ... just typical AD configurations.

Third, yes that's totally possible. You'll just need to create a new custom membership & role provider to use that leverages your custom DB's/CRM to authenticate against.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/18/2006 12:16 PM Ricardo Machado

Hi,
Congratulatios, and thanks to share it with the rest of us.

I found a problem updating the web.config of central administration.
Please, where exactly shoul we put the <roleManeger> tag? In my atempts, after change, site generate an error message.
In my install, central web.config doesn't have this section.

Best regards.
Ricardo
P.S.: Since I'm well over 40's, these types are toooooo small...

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/18/2006 12:42 PM AC [MVP MCMS]

Ricardo - Sorry about the font... get IE7 which lets you magnify the page :). As for the <roleManager> tag, just as the article explains, you should insert it in the <system.web> tag... so you can put both of those just inside the opening <system.web> tag in all web.config's mention in this article (for the Web apps as well as Central Admin). You won't find them in any of the web.config's created automatically... hence why I said you need to add them.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/18/2006 10:42 PM Ricardo Machado

Hi,
That's done.

another Hi,
Thank you very much for your kind answer.
Trying not to go away from the scope of this article, I would like to ask how the IIS IP’s configuration interact with this site.
I’m sending a link for a doc with the screen shots that illustrate my question, if you could be so kind and spare a few minutes to take a look at it.
The problem is that after all, the ‘http://extranet’ site doesn’t show up, but others sites do. Could you give me a clue of what is happening? Is something with the IP’s settings in the IIS?
Best regards.
Ricardo

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/19/2006 6:02 AM Ricardo Machado

Hi,
Sorry if I’m here again…
After introduce the <roleManager> tag in central web.config, site start to give an error:
“connection 'AcSqlConnString' was not found in application configuration or connection sequence is empty”
Please, hot to work around this?
Thanks in advance.
Ricardo

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/19/2006 9:25 AM AC [MVP MCMS]

Ricardo - For your IIS config issues, I make changes to my HOSTS file locally for testing, then specify a host header in the creation of my web application in the steps outlined in this document. As for the connection string error, you didn't follow the article closely. It explicitly states just after Figure 2 that you need to add a connection string section to all the web.config's. Please reread the article.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/19/2006 10:59 AM DavidS

I'm wondering if anyone has seen this before.
I've got a site running as described above, yet when I publish the main site collection, anonymous access does not seem to work anymore.

Has anyone seen this before?

Thanks,
David

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/21/2006 2:43 PM AndyA

Hi, I wondering if anyone has experienced a problem when trying to "Add Users To SharePoint" Group. My issue is once I get to this step, Sharepoint is unable to see users from the database. Instead it stays in the original domain and looks for users (therefore I can't add the user andrewconell).

Since your example works for RTM, I was wondering could there be a problem with my Sharepoint setup?

Also maybe is there anything special about how you're setting up sharepoint (Enterprise or Standard)?

Thanks,
Andy

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/21/2006 4:27 PM AC [MVP MCMS]

AndyA - I don't think you'll have any issues with the version (Enterprise vs. Standard). First thing I'd check is ot veryify all your web.configs are correct because if it can't see the providers, it can't access the stores.

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/21/2006 6:32 PM AndyA

Thanks for your help AC. Actually, I found that the app pool user I used for my site didn't have permission to access the database that was created in SQL, and that was causing the problem.

Cheers,
Andy

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/22/2006 10:11 AM Luca

Thanks for this great article.
As pointed out in conclusion of it, i have to create "a self-registration system for users to create their own accounts and have these accounts automatically registered on the site under a specific role".
My idea is to customize the defaut "login.aspx" page inserting:
1) a "CreateUserWizard" asp.net control, that add a new user in the database
2) a code handler for the "CreatedUser" event that add the user to the site
In your opinion, is it a correct approach?
In particular, about the point #2, how i have to write the code? I have to "impersonate" an other user (owner of the site)?
Notice that in my situation i have not enabled anonymous access.

Thanks very much,
Luca

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/23/2006 1:29 AM AC [MVP MCMS]

Luca - That's definatley one approach. However, I'd change step 2 to be "add user to a specific role in my ASP.NET 2.0 role provider, then assign that role to a specific SharePoint Group." That way, you manage ASP.NET 2.0 roles, and your users are just automatically added to those roles. Nothing to impersonate. This is the approach I'm taking (but I'm building Web Parts, not customizing the login page).

re: MySite service link not available after configuring for Forms Authentication. 12/25/2006 4:01 AM

Thanks much for detailed steps. I did successfully configure Forms Auth. on my site, however I need to provide MySite feature to the portal users. When the site was running on Windows auth. MySite link was available, however after configuring for Forms auth. The link dissapeared. I am not able to get the link back. I have added the ASPNET user created, as the site collection administrator. Also I have changed the SSP (Share d Service Provider) auth mode also to Forms and made the ASPNET user as the site collection admin for SSP site as well.

Any ideas how can get MySite working in Forms authentication.

Thanks much
Shekhar

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/28/2006 12:56 AM Shekhar

HI Anndew i have probelm working of Anonymous Access with Audiances enabled web part. To Summarize

I have been playing with MOSS 2007 RTM and have a site
configured with anonymous access enabled to the entire site. This works
great and whenever a user hits the site, a guest view is displayed and
if they wish to take advantage of personalization, the "sign-in" button
is present to kickoff the authentication process. However, on the guest
page, whenever audience targetting is enabled on a webpart container or
for a particular piece of content within a list, SharePoint initiates an
authentication request. This is not desireable behavior. If SharePoint
is unable to ascertain whether a user belongs to an audience (i.e
anonymous users) then one would expect the webpart or content to simply
not be visible on the page... in guest view. Regardless, SharePoint is
forcing the user to login. This behavior is consistent wether one uses
forms or Windows based authentication....anyone know if its possible to
influence this behavior? I really don't want to have to maintain two
separate sites...

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/4/2007 1:02 AM John

I'm with Shekhar on this. The MySite link has disappeared in my FBA sharepoint site. Any ideas how to make it reappear?

re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/10/2007 11:33 PM ben

Thanks for the article, i followed all the instructions i believe - but when i go to login i get an "Unknown error". Any ideas - anyone else getting this - the error gives no help at all

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 9:29 AM AC [MVP MCMS]

Ben - No way to tell what's wrong with that error. Turn off custom errors and turn on the call stack in the site's web.config to have the real exception be shown on the YSOD.