Adding a secure, internal-only SharePoint Web application / Site collection in existing farm

Hi,
We are currently working on creating a new internal-only SharePoint site that will host sensitive information. We are planning the architecture to provide a secure environment to host this information in SharePoint. We will create the new web app on a separate
database with encryption enabled TDE; we are also planning to encrypt the data through the SharePoint (Insert third-party vendor here) forms before it gets to the SP DB. And obviously, SharePoint permissions will be set accordingly.
Additionally, we would like to have the site accessible
only through our internal network and keep it off the DMZ.
Our current SharePoint environment consists of two web-front end servers (load-balanced) externally exposed (DMZ), one application server and the SQL server both behind the DMZ (internal-only). Currently all of our SharePoint web apps are accessible externally
through SSL.
What is the best way to accomodate this new internal-only web application within our existing farm providing the security measures explained before?
I am thinking on adding an extra WFE server to the existing farm and put it behind the DMZ (internal-only) in a similar way as our application server is configured right now, but just serving exclusively this new internal site's content. I would then
have the NEtwork guys to make the site accessible only to users logged-in internally in our network and through this new dedicated server only. My concern is that since all of our other web apps in the farm are exposed externally, and since the new server
would be part of the same farm, that could be open doors for bad guys to access this information. Are there any other topology options I should consider? I have thought about creating a small (one-server only) new farm just for this purpose, but I am trying
to avoid going that route.
Any thoughts?
Thank you,
Rob

You're mostly going down the right track.
A new web application in dedicated SQL DB and web application policies to deny all external accounts access to the sites will go a long way. You can also make sure that the DNS does not resolve externally.
If you want security you will probably be building the web application on https alone, which is my preference for any farms these days. That might negate the need for your encrypted infopath system.
However you cannot add a WFE to a farm and dedicate a web app soley to that server. Any server with the SharePoint Foundation Web Application role will host all web applications. You can steer traffic to one
server or another but that's not really doing much for security. If it's on one WFE it's on them all. For that reason I would say that the standalone farm is the best, most secure, solution.
All of what you've been describing will help with security but you'll have to spend hours testing connections, securing files and testing testing testing. Whilst the standalone will just work.
No, i don't know why that turned into tiny print either.

Similar Messages

Missing applications for the SharePoint Web Services site in IIS

We have SharePoint 2013 server farm and in one of the server missing service applications/virtual directories.
Under IIS, “SharePoint Web Services" site including an Application Pool and SharePoint Web Services Root is available, but no applications for the SharePoint Service Applications, all applications (security token service, topology ..) virtual directories
are missing/removed/deleted.
Can we re-provision only service applications on local SharePoint server, local server only not in any other servers in the server farm?
Thank You.
-RK

Hi RK,
Please check if services has been started on this server via CA > System Settings
> Manager services on server > change server to the current one.
Is there other application server in your farm? Please test the issue on other servers.
Regards,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected] .
Rebecca Tu
TechNet Community Support

Cannot delete SharePoint web application again

While deleting web application
Central admin gives error:
Sorry, something went wrong
An object in the SharePoint administrative framework, "SPWebApplication Name=ShareAppsUAT", could not be deleted because other objects depend on it. Update all of these dependants to point
to null or different objects and retry this operation. The dependant objects are as follows: correlation id
ULS log shows following error
Unknown SQL Exception 547 occurred. Additional error information from SQL Server is included below. The
DELETE statement conflicted with the REFERENCE constraint "FK_SiteMap_Application". The conflict occurred in database "SharePoint2013UATEnterprise_Config", table "dbo.SiteMap", column 'ApplicationId'. Table 'LastUpdate'.
Scan count 0, logical reads 2, physical reads 0, read-ahead reads 0, lob logical reads 0, lob physical reads 0, lob read-ahead reads 0. The statement has been terminated.
I had similar thread https://social.technet.microsoft.com/Forums/sharepoint/en-US/74e06180-f066-47e0-8895-3e909206b9e9/cannot-delete-sharepoint-web-application?forum=sharepointgeneral
The only difference is error in central admin. Before for another web application i got
Object not set to a reference of an object. now i am getting An object in the SharePoint administrative framework, "SPWebApplication Name=ShareAppsUAT", could not be deleted because other objects depend on it. Update all of these
dependants to point to null or different objects and retry this operation. The dependant objects are as follows: in both powershell and central admin.
Solution in above thread gives following error for this case
Exception calling "Delete" with "0" argument(s): "An object in the SharePoint administrative framework, could not be deleted because other objects depend on it. Update all of these dependa nts to point to null or different objects
and retry this operation. The depend ant objects are as follows: Web Application name.
How to solve it? It is like a loop. If i go to delte web appliction it says content database is dependent object and if i do for content database it says web application is dependent object
Adit

Hi Adit,
From your description, the issue might be caused by orphan items in sitemap.
Please execute command below to check IDs and site map status for all site collections and subsites in the issue content database:
stsadm -o enumallwebs -databasename <database name>
Then use the command below to delete orphan sites:
stsadm -o deletesite -force -siteid <siteid> -databaseserver <database server name> -databasename <database name>
Now run IISReset and try delete web application via:
Remove-SPWebApplication - identity http://sitename
For related information:
http://technet.microsoft.com/en-us/library/dd789634(v=office.12).aspx
http://technet.microsoft.com/en-in/library/cc288016(v=office.12).aspx
http://technet.microsoft.com/en-us/library/ff607891(v=office.15).aspx
Regards,
Rebecca Tu
TechNet Community Support

Cant login sharepoint web application

Hello exports.
I have a problem. My company needs to some users restrict logon to PC. I have a few users with logon restrictions and they havnt login sharepoint web application for my intranet web.
User1 have login to my domain controller name for authenticate some web browser application. But cant login sharepoint web application. I have changed User1 logon to all workstation can login sharepoint.
Please tell me sharepoint authentication mechanism and how to resolv my problem?
Thanks and regards

So if a user has the userWorkstations attribute set, they cannot log into SharePoint? Have you tried adding the SharePoint servers into the userWorkstations attribute?
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Setup Team Foundation Server - Team Site Collection - SharePoint Web Application Settings failed with error TF205014, TF250025

Hi
I have TFS server installed and working with other SharePoint farm. (TFS installed, SharePoint extension installed and Granted Access for TFS.
When Setup TFS - SharePoint Web Application Settings, It ask for the three values:
Web Application URL:
Central Administration URL:
Default Location of team project collection sites:
What notice about the TFS sites that are working is that they are Path Based Site Collection. Created with SharePoint Web Application managed path (like
http://spserver/sites/tfs_site1) and so it easy to see it will work.
Web Application URL: http://spserver
CA URL :   http://spserver:portnumber
Default Location : Sites or any managed path
We start using Host Name Site Collection (HNSC) to get the benefit of multiple unique site name without having multiple web application for each. Work great but when we tried to setup and extend TFS service on the HNSC, we could
not get them to work and got errors when trying different variation of path URL.
After doing lot of searching on this, I came up pretty empty and I don't know if that is possible so my question is Have anyone able to setup TFS to work with SharePoint 2013 Host Name Site Collection?
If you have, a simple yes will be great but please share or even if anyone think it is possible or not possible, please share too.
Thanks in advance for any comment / suggestion.
Swanl

Hi Swanl,
I’m afraid that we cannot setup TFS to work with SharePoint 2013 Host Name Site Collection.
Also you can initial a new thread in Visual Studio Team Foundation Server forums：
Team Foundation Server – General: http://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=tfsgeneral
More experts for Team Foundation Server will assist you, then you will get more information relation to your issue.
For integrating SharePoint 2013 with Team Foundation Server 2013 you can have a look at the following blog:
http://nakedalm.com/integrate-sharepoint-2013-with-team-foundation-server-2013/
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support,
contact [email protected]
Eric Tao
TechNet Community Support

Does Developer 9i only for web application

Dear Friends,
Does Developer 9i only for web application?
Thanks

Although in theory you can install the client and the application server on one machine so you can be "2 tier" but yes, client/server was desupported back in 6i.

Not able to set security group without mail enabled as site collection admin using powershell in sharepoint online site - office 365

not able to set security group without mail enabled as site collection admin using powershell in sharepoint online site - office 365?
Any idea?

after few days test in my lab, I can see that only email enabled group can be added as site collection admin using POWERSHELL.
hope this helps who stuck like me!! :-)

Create web application in powershell using existing app pool

Hi all,
I am trying to create a web application with this script:
https://gallery.technet.microsoft.com/office/Create-SharePoint-2013-1d7c3337
The problem is that I want to use an existing app pool, but when I do I get this error:
Aborting: Application Pool SharePoint - Applications already exists on the server and is not a SharePoint Application Pool
Obviously this is wrong, since I use this app pool for most of my web apps.
So how does one go about creating a web app in powershell with an already existing app pool?
-Michael
mic

try these links:
http://sharepoint.stackexchange.com/questions/81297/creating-a-webapp-via-powershell-is-mapping-the-site-to-wrong-apppool
http://blogs.technet.com/b/fromthefield/archive/2014/03/26/create-a-sharepoint-application-pool-using-powershell.aspx
http://blogs.msdn.com/b/rcormier/archive/2012/09/01/how-to-create-sharepoint-web-applications-with-powershell.aspx
Please mark answer as correct if it is correct else vote for it if you find it useful Happy SharePointing

Bex Web application "2" does not exist

Folks,
We are getting this error :
<i><b>Bex Web application "2" does not exist . The application was either ended by a timeout or an error occured , which was entered into the trace log</b></i>
Please advise
Thanks,
Manish

This happens during a session timeout or error.
You can login back and it should work.

Book for Web application(site) (Application(site) for voice tutorial) for m

Please tell me some not very book or example for developing Web application(site) (Application(site) for voice tutorial) for mobile devices what use web services(for the voice tutorial)
Please(if can ,if can not it's all right) application to be like version for attaching on the web server.

Use the resources you pay for with a dev account in the iOS Dev Center(s).
iOS Human Interface Guidelines
iOS Starting Point
Start Developing iOS Apps Today
App Development Overview
App Store Review Guidelines for iOS Apps
Your First iOS App
iTunes Connect Developer Guide
iTunes Connect Guide
Learning Objective-C: A Primer
Also: iTunes U

Error when create a project in newly Enabled features for Project Web App site collection in Project Server 2013

I Enable the Project Web App site collection features in Project Server 2013 based on
http://technet.microsoft.com/en-us/library/jj200305.aspx
when i try to create a project i get error "GeneralUnhandledException"
Yasser

Also, after you provisioned PWA, are you able to get to the server settings? Did you do any configurations with PWA or using the defaults?
Are you trying to add the project using the FarmAdmin account or did you add yourself as a resource with project manager role?
Cheers!
Michael Wharton, MVP, MBA, PMP, MCT, MCTS, MCSD, MCSE+I, MCDBA
Website http://www.WhartonComputer.com
Blog http://MyProjectExpert.com contains my field notes and SQL queries

Where is security configuration for deployed web application stored

Hi,
We have deployed a folder as a web application. The changes I am making in Deployments -> web application -> Security -> URL Pattern -> Roles -> Edit a Stand-Alone Web Application URL Pattern Scoped Role is not saved and it is getting lost when I restart the application.
For example I have added "AppTesters" group in "valid-users" url-pattern.
Can anybody help me where these settings are stored and why it is not getting saved across application restarts.
Thanks,
Sambath.

How are you restarting your weblogic Admin Server?
This is only possible if some how while your Admin Server is restarted, the ldap directory that is present int the %DOMAIN_HOME%/your_domain/servers/AdminServer/data directory is deleted or updated with the previous values.
This may give you some idea how to proceed with this issue.
Thanks,
Sandeep

Secure and non-secure access to the web application in one war

Say we have one web application (in one war) which includes JSP, servlets and the security intercepter. There is one business requirement to have most of the JSP(s) accessed via HTTPS, but a few JSP(S) accessed via HTTP.
My questions are:
a. Is this possible, or a reasonable requirement or a good practice?
b. if yes, what can we do to make it happen in the security intercepter implementation?
c. If not, what is the technical reasons?
Thanks much.

a) Yes its is reasonable and good practive, there is an overhead using https, so you should only encrypt file you need to. When you use an online store, only account details / payments are https, the shop itself is http
b) I dont really understand your difficulty. You can define a folder as 'secure' and put all your secure pages in this folder, leaving non secure files in a different folder. Whenever a page in the secure folder is accessed, https is automatically invoked.

SharePoint 2010 - Create new site collection in existing web application with different existing content DB

I have a SharePoint 2010 root level site collection SC1 in web application WEBAPP1. I want to create copy of that site collection in same web application WEBAPP1. Apart from Import/Export, Restore/Backup options, will following approach work? If yes , how?
I took backup of content database of web application.
Restored database with different name
Mounted Content database to this WEBAPP1 by assigning new ID to DB
Created new site collection by using this newly mounted DB
Site collection gets created successfully but content does not appear.
Please guide if i can achieve desired functionality by using this approach.
If this helped you resolve your issue, please mark it Answered

It is because the Site GUID is identical, and each GUID can only be present on the farm once. You can use Backup-SPSite/Restore-SPSite (which is full-fidelity, unlike Export-SPWeb/Import-SPWeb), which will generate a new GUID for the restore Site Collection,
even in the same Web App.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Adding a WebService Client to a Web Application

Hi, Everybody,
I built a Bepl Module in which I had a ECHO WebService and the response parameter is a complex type.
Then I built a Web application, and used the WSDL file to add a WebService Client to a this Web Application,
but I found that the WebService Referrence dose not contain any method, so I could not add it in my jsp page.
But when I changed the Response Message Part Type into a simple one, everything worked fine.
*All the progress is the same as " [Using a Manually Created WSDL as a Web Service Client|https://open-esb.dev.java.net/kb/v2/javaeesetut.html] ", but change the simple type into complex type.*
I want to know if the WebService Client Referrence dose not support generating java code which contains complex type or I had a wrong operation?
thanks

There are current limitations with the wsimport functionality and an issue has been logged.
If you have a look at the blog entry from Andrew Hopkinson.....
[http://blogs.sun.com/toxophily/entry/javacaps_tip_migrating_a_simple]
...you'll see part way down what the WSDL must look like to work with wsimport, i.e.....
Message parts must be created using an Element rather than a specific type and the element must be defined in a local in-line schema.
This in-line element can only contain a sequence with a single sub-element of a specific Complex Type.
The name of the input element must be the same as the operation it will be used in.
nillable element option should not be used because this will cause your strings to be returned as JAXBElements and not Strings.
...etc....
Bit painful I know, but this is the only workaround until the bug is fixed.

Adding a secure, internal-only SharePoint Web application / Site collection in existing farm

Similar Messages

Maybe you are looking for