Internet - Intranet User Authentication

Hi All,
I am having the following question which would got answered previously but please help me to clarify below scenario
Single AD Forest
Single AD Domain
Single AD site
DNS - split brain , we are using same namespace for both internet and intranet ( eg: xyz.com )
one production application ( IIS and .net )
500 users , no VPN users
Users are access production application seamlessly
Requirement:
Organization want the application to be internet accessible. Post hosting, how does users access the application?
eg: User --> IE --> URL :www.financial.xyz.com, it prompts for user name and password
Question: What user id should I need to provide ? , do I need to establish forest trust between ISP and internal domain ? , or do I need to use ADFS to establish federation between ISP and internal
domain ? requirement is to use internal users for authenticating the application

You can proceed as Frank already mentioned.
Assuming that this is the only Website you will be publishing, you can simply redirect traffic on HTTP and HTTPS ports from the external networks to the Website - You should be able to do that on your frontal network equipment. If you have multiple Websites
that will share the same IP address then a Application Layer reverse-proxy is needed unless if they do not use the same ports.
Of course, you will need to create the required DNS record for external DNS resolution and make it point to your public IP.
There are no needs to establish trust relationships with your ISP. You can also use ADFS but it is not really required.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Similar Messages

Need help for creating sharepoint sites for both internet and intranet users

We would like to know what is the best approach to create SharePoint sites for our customers(internet users) and internal employees(intranet users) on the same SharePoint server. Here is the scenario:
1) A customer posts a document from internet.
2) This triggers a approval workflow that can only be accessed and executed in the intranet environment. This approval process requires approval's possible modifications to the customer's document.
3) We would like the customer not to able to check the approval state and the modified document until the document is fully approved and finalized.
We are pondering if we need to create two sites, one site for customer and the other site is for internal approvers. Or one site is possible. It also looks like we need to somehow copy customer's original document to intranet site and triggers the workflow.
Any design ideas are helpful. Thank you advance!

Hi Jason,
Though it is perfectly possible to have both intranet and internet on the server, it is not a recommended practice. Having both on the same server would have multiple problems, instead me detailing it out, here is a forum thread on which Trevor had given
enough reasons -
http://social.msdn.microsoft.com/Forums/sharepoint/en-US/9b550c33-6f5f-4cd9-8762-8ff389b747d9/sharepoint-2013-one-farm-to-host-intranet-extranet-internet?forum=sharepointadmin
If you have valid reason to go with single server, then you can also explore email enabled lists as one option and another one would be using custom sharepoint designer workflow.
you can also try using event receivers to send documents to intranet site from internet site, process everything and update the document in the internet site.
Hope this helps!
Ram - SharePoint Architect
Blog - SharePointDeveloper.in
Please vote or mark your question answered, if the reply helps you

Configure User Authentication on SOAP Receiver Adapter

Hi,
I am calling a WebService that is available over the internet. We are on PI 7.1 and I am using a Soap Receiver Adapter. The configuration was downloaded from SAP in a partner package. The development in the package was done on XI3.
I need to call the WS with user authentication. I've selected the "Configure User Authentication" radio button and entered the username and password. The message fail with "HTTP 401 Unauthorized" and it is because the user details are not being send from the adapter. If I copy the XML payload to a XML tool, like Stylus Studio, I can call the webservice successfully. I've read through numerous blogs and messages on this Forum, including adding the adapter module (MessageTransformBean) and changing the Conversion Parameters without any luck.
Any suggestions please?
Thanks

I am calling a WebService that is available over the internet.
I copy the XML payload to a XML tool, like Stylus Studio, I can call the webservice successfully.
normally the webservices that we use (from internet) are freely available...meaning they dont require any username/ password.
if no credentials are required then do not select Configure User Authentication...uncheck it....if user-details are provided by the Webservice, then use these details (not your XI/ PI user details) in the channel.
Are you using any user-name/ password while testing from SOAP tools?
Regards,
Abhishek.

Not Authorized HTTP Error 401. The requested resource requires user authentication.

Hi All,
I have MDS web application on one server and MDS DB on another, both in same domain .
MDS web application is created as new website on same IIS with SharePoint and have their own port assign
In IIS Windows Authentication is added and enabled.
Users do have function permission and module enabled.
MDS is accessible only on server where web application is.
When it is accessed from any computer within domain error is
Not Authorized
HTTP Error 401. The requested resource requires user authentication.
Can anyone offer any suggestions?
Thanks
Zorko

Hi Zorko,
The issue may happen in case:
1. The Master Data Service(MDS) web application is running under a domain user account
2. You didn't register a Service Principal Name(SPN) for the account
3. You are using fully qualified domain name(FQDN) or host name to access the MDS
4. You are able to access the MDS by IP address(http://<ip address>)
If I am right, it is because of the browser choose to use Kerberos authentication to connect to the MDS.
So then, to fix the issue, please:
Register SPN for the application pool account. Enable the delegation.
Or, please force the web site to use NTLM authentication only.
For more information, please see:
How to use SPNs when you configure Web applications that are hosted on Internet Information Services:
http://support.microsoft.com/kb/929650
Forcing NTLM Authentication (IIS 6.0):
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/7258232a-5e16-4a83-b76e-11e07c3f2615.mspx?mfr=true
Thanks,
Jinchun Chen
Jinchun Chen(JC)
TechNet Community Support

Trusted User Authentication

Hi,
Our solution currently offers three SSID's. One corporate SSID for trusted users (employees) with trusted (company managed) devices, one guest SSID for external guests who are not trusted and use non-trusted devices and then a third "guest" SSID that allows trusted users (employees) to connect using untrusted (personal) devices to access the Internet via a separate proxy system. The guest SSID for trusted users is the focus of this question.
We currently use a local RADIUS database on ACS 5.2 for the users, which works but requires another user account and obvious password management overhead. Given that a global employee directory exists which has its own account & password management system in place has made me consider this as an alternative to local authentication on ACS.
The external identity store is an LDAP database and I have configured network access for the ACS to query the schema.
I understand that web authentication can use LDAP as an authentication mechanism, however I would like to keep the SSID as secured using 802.1x if possible and not use an open or PSK secured solution as this would contravene current security standards.
So, can I configure the WLC to send an authentication request to the ACS via RADIUS over 802.1x and then for the ACS to forward that request on to an external identity store using LDAPS?
I am currently reveiwing the configuration document and believe I have each individual component in ACS configured but cannot see the LDAPS traffic ever leaving it to query the external identity store.
Any thoughts or comments would be appreciated....
Thanks,
Dave

Hi Dave,
That is surely possible and that is what LDAP identity store is fore.
You create the LDAP identity store and point the WLCs to use the ACS (not the LDAP server).
Now, when a wifi client tries to connect the WLC sends the request to the ACS.
At this point the request reached ACS. So, in order to proceed with quering the LDAP server for that user, you need to tell the ACS for this user that is connecting to this SSID please send the query to the LDAP server and trust what it tells you about the user authentication status.
Have you configured this piece of configuraiotn on ACS? to send the traffic to the LDAP DB?
In the Access policy you need to choose the configured LDAP identity store. Have you done that?
If you still have problems please try to provide screenshots of you config.
Regards,
Amjad
Rating useful replies is more useful than saying "Thank you"

Setup Java system directory server 6 client for user authentication

I am trying to set up a native LDAP client for sun directory server 6 for network based user authentication. I checked the sun doc for naming service (LDAP) and the documentation are for setting up LDAP client for directory server 5. Is there any documentation for setting up LDAP client for directory server 6? Or the documents for setting LDAP client for directory server 5 is still good for 6? Particularly, I want to use SSL communication between server and client.

Hi,
could be one of the other 'bad jokes' of DS/ldapclient because the documentation describes a lot of stuff about profiles etc. but: you need some special schema files to use the whole stuff and they are not installed with Solaris or DS (and they include the NisDomainObject). I had to search for them in the internet. They are also printed in the documentation. Save them in your server's config/schema directory as i.e. 61DUAConfigProfile.ldif and 62nisDomain.ldif and try idsconf again (maybe you have to cleanup something).
I test and prepare DS6 here, and we will use it in production too. I hadn't any problem with it and it has some important advantages over DS5.2. But we won't have a huge directory so I can't tell you anything more about it.
Regards
Jochem Ippers
Here are the ldifs:
61DUAConfigProfile.ldif:
dn: cn=schema
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.0 NAME 'defaultServerList' DESC 'Default LDAP server host address used by a DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.1 NAME 'defaultSearchBase' DESC 'Default LDAP base DN used by a DUA' EQUALITY distinguishedNameMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.2 NAME 'preferredServerList' DESC 'Preferred LDAP server host addresses to be used by a DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.3 NAME 'searchTimeLimit' DESC 'Maximum time in seconds a DUA should allow for a search to complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.4 NAME 'bindTimeLimit' DESC 'Maximum time in seconds a DUA should allow for the bind operation to complete' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.5 NAME 'followReferrals' DESC 'Tells DUA if it should follow referrals returned by a DSA search result' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.6 NAME 'authenticationMethod' DESC 'A keystring which identifies the type of authentication method used to contact the DSA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.7 NAME 'profileTTL' DESC 'Time to live, in seconds, before a client DUA should re-read this configuration profile' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.14 NAME 'serviceSearchDescriptor' DESC 'LDAP search descriptor list used by a DUA' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.9 NAME 'attributeMap' DESC 'Attribute mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.10 NAME 'credentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.11 NAME 'objectclassMap' DESC 'Objectclass mappings used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.12 NAME 'defaultSearchScope' DESC 'Default search scope used by a DUA' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.13 NAME 'serviceCredentialLevel' DESC 'Identifies type of credentials a DUA should use when binding to the LDAP server for a specific service' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'user defined' )
attributeTypes: ( 1.3.6.1.4.1.11.1.3.1.1.15 NAME 'serviceAuthenticationMethod' DESC 'Authentication method used by a service of the DUA' EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
objectClasses: ( 1.3.6.1.4.1.11.1.3.1.2.4 NAME 'DUAConfigProfile' SUP top STRUCTURAL DESC 'Abstraction of a base configuration for a DUA' MUST ( cn ) MAY ( defaultServerList $ preferredServerList $ defaultSearchBase $ defaultSearchScope $ searchTimeLimit $ bindTimeLimit $ credentialLevel $ authenticationMethod $ followReferrals $ serviceSearchDescriptor $ serviceCredentialLevel $ serviceAuthenticationMethod $ objectclassMap $ attributeMap $ profileTTL ) X-ORIGIN 'user defined' )
62nisDomain.ldif:
dn: cn=schema
attributeTypes: ( 1.3.6.1.1.1.1.30 NAME 'nisDomain' DESC 'NIS domain' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'user defined' )
objectClasses: ( 1.3.6.1.1.1.2.15 NAME 'nisDomainObject' SUP top STRUCTURAL MUST nisDomain X-ORIGIN 'user defined' )

Intranet AD Authentication

We have a new SharePoint 2013 with a 1 server farm we will be using as an Intranet for our company (No extranet) with AD authentication. We would like to require a daily input of the Username/Password from the user.
Is there a simple way to have AD and SharePoint require a daily logon without using a Claims-based authentication? We have already looked at changing the User Authentication settings on individual machines (Prompt for username and password") but it
will not effectively meet our logon requirement unless we have the cache cleared each time the user closes the browser.

Effectively, no. There are various caches (Distributed and STS) that hold onto a token for the user, in addition to the user being able to adjust IE's setting (adding the site to the Intranet Zone, if it isn't already part of the zone, for example).
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

User Authentication for subfolder not working in Web Browser

We are using Oracle Application Server 10.1.2.3 and Database Server 10.2.0.5 for our application.
One of the functionalities of the Application is to send emails with attachments.
The logic is that the Application would generate the attachment file on the Application Server.
Then a database package uses Oracle's utl_http package/procedures(more specifically utl_http.request_pieces where the single argument is a URL) to pick up the file from the Application Server via URL, attach the file and send the email.
Exchange and Relay Server is also set in the Application.
The problem is that the folder containing the folder which stores the attachments is having user authentication set.
Example : The main folder is /apps/interface, this folder requires a valid user when it is accessed via URL on a web browser.
Alias created in httpd.conf
Alias /int-dir/ "/apps/interface/"
The folder /apps/interface/email/ is the folder where the attachment files are generated and stored.
Application Server : 10.12.213.21
Database Server : 10.12.213.22
Email Server : 10.12.213.44
Configuration as per httpd.conf
Alias /int-dir/ "/apps/interface/"
<Location /int-dir/>
AuthName "Interface folder"
AuthType Basic
AuthUserFile "/u01/app/oracle/as10g/oasmid/Apache/Apache/conf/.htpasswd"
require user scott
</Location>
<Location /int-dir/email>
Options Indexes Multiviews IncludesNoExec
     Order deny,allow
     Deny from all
     Allow from 10.12.213.21
     Allow from 10.12.213.22
     Allow from 10.12.213.44
</Location>
Using the above configuration the Application is able to attach the files and send the email, however, when we access the following URL :
http://10.12.213.21:7778/int-dir/ - it prompts for user authentication
However if we use the following URL :
http://10.12.213.21:7778/int-dir/email/ - it does not prompt for user authentication, and all the files in the folder are displayed in the browser.
I have tried so many things including AllowOverride, .htaccess, but i am not able to get user authentication for the email folder.
Please help me if you can.
Thanking you in advance,
GLad to give any more information that i can.
dxbrocky

Thanks for your response. I fixed the problem by selecting "full site" or "full website" at bottom of the web page. After making this selection the zoom function returned. Thanks again for your interest.

User Authentication failed

Hi all,
I like to share one of my peculiar issue with you and like to get a solution as well.
I am trying to install a portal server with r3load based method. I did a java export of mssql Portal server and suceefully imported in the newly installed server.The server is up and running.I also completed the post installation activites like SLD ,SSO and Jco creation. I am not able to log in to the java page using administrator user and also other users..It keep on saying that user authentication is failed.
But the beauty is that using the same adminsitrator user i am logging in the visaul administrator .
I dont know where the problem and also i verified the log files under cluset/server nodes. There i found the log as follows --- > Connection is already closed and no longer associated with a managed connection,,
I dont know where i am missing. Due to this I reinstalled the server and imported again..But the same problem is existing to me. Anyone have suggestion on this please do reply.
Thanks and Regards
Vijay

Hi,
Thnaks for reply. Its only a java system ,, So no activity needs to be done in SU01. I checked the table in database..the users are exisitng as well in the table.
FYI: I am able to log in visaul admin but not in the java pages like
http://<hostname>:port/
http://<hostname>:port/irj
Hope i explained my problem it in right way
Regards
Vijay

Email Receiver Dynamic User Authentication, is it possible?

Hello Experts,
I have a scenario SAP ECC->SAP PI->Gmail Mail Server, now the interface is working fine, the thing is that I want to configure the user Authentication in a dynamic way, I tried to doit in a UDF in the Message Mapping, using the dynamic values for:
TServerLocation
TAuthKey
fields, but is not working, am I using the correct header fields?, or is there another way to change this parameters?, thanks in advance for your answers.
Regards,
Julio Cesar

Hello Gopal,
Im using Plain, it works fine if I fill up the fields for User and Password in the comm channel, but if I try using the fields in a Dynamic way is not working, thanks for your answer.
Regards,
Julio

Use Microsoft Online Directory Services as a user authentication provider for our own SharePoint farm?

Hi,
I've managed to configure my farm so that Microsoft Online Directory Services (Office 365 etc.) can be used for STS authentication, but what I'm actually trying to do is allow user authentication - that is, I'm hoping to be able to use the user's
O365 credentials to authenticate them in my own farm so they can view certain parts of it. If I need to write my own login form or authentication provider or whatever that's fine, as long as the user doesn't need to enter anything when they access my farm
(provided they already have cached O365 credentials in their browser session).
FWIW I actually need to be able to support the possibility that users are coming from multiple O365 tenancies, whereby each site collection will be configured to allow users from a different O365 tenancy (more or less).
If it's not possible to do with my own development farm on a PC, it is possible if the farm is hosted in Azure?
Thanks
Dylan

Hi Dylan,
According to your description, my understanding is that you want to use Microsoft Online Directory Services as a user authentication provider for your SharePoint farm.
For your demand, you can configure a hybrid topology for your SharePoint farm:
http://technet.microsoft.com/en-us/library/jj838715(v=office.15).aspx
http://technet.microsoft.com/en-us/library/dn197168(v=office.15).aspx
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support,
contact [email protected]
Eric Tao
TechNet Community Support

User Authentication in Web Dynpro Java

Hi guys,
I was just wondering how user authentication can be achieved in WDJ? In Web Dynpro ABAP this comes for free when you launch an application. However, in WDJ we can deploy and call the URL without any authentication at all. Is there a way to configure this or do we really have to code this? Thanks! Generous points will be awarded!

Hi Alex,
check this links,
Re: User Authentication in Web Dynpro Application
Authentication of Web Dynpro
Using Web Dynpro authentication for a Web Service call
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/dd48d990-0201-0010-92a3-c3ed7e9fd244
http://help.sap.com/saphelp_nw04s/helpdata/en/04/ee8b8b0d23b746854897adc5611c1d/frameset.htm
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/8304e990-0201-0010-ed8b-d978f1e67b1e
Regards,
vino

With 3.6.12, Help menu item "For Internet Explorer Users" results in a "Page Not Found" error. Is this a known bug? Is it being addressed?

Clicking the 3.6.12 Help menu item "For Internet Explorers" item results in a "Page Not Found" error.
The URL of the resultant page is https://support.mozilla.com/en-US/kb/Windows%20start%20page?as=u
Is this a known bug, if so, is it being addressed? If so, someone needs to work faster.
If it is not a known bug, someone needs to get right on it - you want people to switch to Firefox and then there is this bug -- not a good way to impress Internet Explorer users.

Hi Claudio Roca,
I have encountered the same problem. Do you found the solution for this issue? I will much appreciated if you willing to share your solution and email to [email protected] Thank you so much.
Regards,
Hau Chee

In help, it said, for internet explorer users how to remove it

when i some news in yahoo firefox said error and said start a new season.
and still can't open it.
in menu bar help, for internet explorer users how to remove it. thanks.

See:
* http://kb.mozillazine.org/Firefox_crashes
* [[Firefox crashes]]
* http://kb.mozillazine.org/Browser_will_not_start_up

End-to-End user authentication with XI

Dear community,
we sit in a situation where the customer wants to have an end-to-end-authentication throughout an integration process.
The setup is as follows: a dialog-user in a legacy system uses an application that triggers an integration process through XI into SAP ERP. The dialog-user in the legacy system must be used for authentication in XI as well as SAP ERP.
To avoid having to re-create all users in XI and SAP ERP, ideally an LDAP instance would be used for authentication.
Based on my knowledge, the above scenario is not possible with XI and there is a 2 year old thread discussing the same without any positive outcome:
XI and user authentication VS R/3 systems
Nevertheless I consider this requirement as a pretty standard one. Has there been any development in this area - or how have similar customer requirements been met ?
Thanks a lot in advance !
Jochen

Hi Jochen,
i've heard rumours saying that credential forwarding will be incorporated in the next XI release as it is a rather frequent requirement by customers and will make live much easier.
Maybe you can get a statement through your clients SAP account representative on the release date and the planned feature.
Regards
Christine

Internet - Intranet User Authentication

Similar Messages

Maybe you are looking for