Technical Class:

1. Planning and Configuring
Extranets in SharePoint 2010

2.  Geoff Varosky
 Jornata
 Managing Consultant, Senior Architect, Senior Developer, Director of
Evangelism
 President & Co-Founder Boston Area SharePoint Users Group
 Co-Organizer SharePoint Saturday Boston
 Recent Awards
 Top 25 2012 Harmon.ie Online Community Influencer
 Top 50 2012 KnowledgeLake Community Influencer
 Blog – www.SharePointYankee.com
 Email – geoff@varosky.com
 Twitter – @gvaro

4.  Thinking
 What is an Extranet?
 Design
 Topology
 Authentication Mechanism
 User Identity Storage Location
 Evaluating Your Requirements
 SharePoint 2010 Considerations
 Doing
 Configuration
 User and Role Management

7. Controlled access from
external networks

8. Controlled access from
EXTeRnAl NETworks

10.  Topology
 Authentication Methods
 User Identity Storage Location

13. Corporate network
a/k/a where you access
Internets Perimeter network Facebook from every
morning
External Firewall/UAG Server Farm
Users

14. Internets Perimeter network Corporate network
Firewall Router A Router B Firewall
/UAG /UAG
LAYER 1 LAYER 2 LAYER 3
Web Servers APP & SQL DNS, Active Directory,
Servers LOB Systems

15. Internets Perimeter network Corporate network
External Firewall Firewall
Users /UAG /UAG
CONSUMING SERVICES FARM
FARM

16. Corporate network
Internets Perimeter network
YAY! FACEBOOKS! LOLS!
External Firewall Firewall
Users /UAG /UAG
Web Servers, SQL Servers,
Application Application
Servers, Servers,
DNS, Active DNS, Active
Directory Directory

18.  Windows
 NTLM
 Kerberos
 Basic
 Forms Based Authentication (FBA)*
 *Claims needs to be enabled for FBA
 Claims Based Authentication
 SAML tokens

20.  Active Directory
 LDAP
 SQL Server
 Other
 Facebooks
 Twitters

22.  What do you really need?
 Who needs access?
 How sensitive is the data?
 How sensitive is the network?
 Budget?**

23.  Who needs access?
 Internal employees only
 Active Directory
 Internal employees and external users
 Active Directory
 Additional domain with restricted access
 Active Directory & Forms Based Authentication
 Claims Authentication
 External only (rare)
 Clients, partners, consultants
 Active Directory or LDAP or SQL?
 Forms Based Authentication or Windows auth?
 Separate or together?
 Hosting
 Mobile Clients

24.  How sensitive is the data & internal network?
 Network & SharePoint
 Separate site?
 Separate site collection?
 Separate web application?
 Multiple farms with cross-farm services & publishing?
 Separate farm?
 DMZ?

25.  How sensitive is the data & internal network?
 Security
 Secure Certificates (SSL)
 Encryption
 Firewall
 Both hardware and software?
 Content Filtering
 ACLs
 Virtual Private Network
 Anti-Virus and Anti-Malware
 Client-based certificates
 One-time passwords (RSA tokens)
 Phone verification
 Biometrics
 Retina, fingerprint, facial structure, hair and blood samples

26.  How sensitive is the data & internal network?
 Security
 Secure Certificates (SSL)
 Encryption
 Firewall
 Both hardware and software?
 Content Filtering
 ACLs
 Virtual Private Network
 Anti-Virus and Anti-Malware
 Client-based certificates
 One-time passwords (RSA tokens)
 Phone verification
 Biometrics
 Retina, fingerprint, facial structure, hair and blood samples

27.  Budget**

28.  REMEMBER THIS…
You are giving a key to
access your company’s
data in some form or
another.

30.  Supported versions
 All – Foundation up through Enterprise
 Office 365
 Can be used as an extranet (since that is basically what it is!)

31.  Assumptions
 Any Topology
 Multi-Mode (Windows & FBA Authentication)
 SQL User Database
1. Create ASP.NET Membership Database
2. Configure SharePoint
3. Configure IIS
4. Create and Manage Users

32.  IIS
 Using your SharePoint Site = BAD
 Must first change default role manager, and then membership provider each time from
claims to your SQL providers
 No one can log into SharePoint during this time
 And then change them back when done
 Each change recycles the application pool.
 Create a separate IIS Virtual Web Application and Manage from there
 BCS
 Great way to search for and manage users (passwords, email, etc.)
 No way to create users without additional logic

33.  CodePlex (www.codeplex.com)
 SharePoint 2010 FBA Pack
 http://sharepoint2010fba.codeplex.com
 Third Party Solutions

34.  Test your configuration
 Review security regularly
 Be wary of cats

35.  My Blog Series
 Part 1 : http://go.gvaro.net/ExtranetsP1
 Part 2 : http://go.gvaro.net/ExtranetsP2
 Part 3 : http://go.gvaro.net/ExtranetsP3
 Phone Factor – Phone Verification
 http://www.phonefactor.com
 Plan Security Hardening (TechNet)
 http://go.gvaro.net/uSyY1Z
 SharePoint 2007 & 2010 Farm Ports (Firewall Config)
 http://go.gvaro.net/uWQZzU
 Disabling SSL v2.0, PCT 1.0 +more in IIS7
 http://go.gvaro.net/N5GgEa

36.  SharePoint Ports, Proxies, and Protocols (Firewall Config)
 http://go.gvaro.net/tblxCn
 Harden SQL Server for SharePoint
 http://go.gvaro.net/viVQuN
 Visual FBA configuration by Donal Conlon
 http://go.gvaro.net/oPnAYx
 Extranet tested topologies for SP 2010 Model
 http://go.gvaro.net/SP2010ExtTopMod
 ASP.NET 2.0 Membership Database Reference
 Create, Add Users, etc. http://go.gvaro.net/AN2Mbr

37.  FBA Configuration in SharePoint 2010
 LDAP: http://go.gvaro.net/FBALDAP
 ASP.NET Membership DB
 http://go.gvaro.net/FBAANMDB
 PeoplePicker Wildcard Search
 http://go.gvaro.net/FBAWildCard
 Helpful Resources for Troubleshooting Membership Providers
 http://go.gvaro.net/TSMemProv
 “Sign me in automatically” in FBA
 http://go.gvaro.net/pAkDQP
 Configuring SSL in a Development Environment
 http://go.gvaro.net/uOTTlJ

39.  Meets 2nd Wednesday/month
 6-8PM
 Microsoft N.E.R.D. (Cambridge)
 BostonSharePointUG.org
 Twitter: @BASPUG / #BASPUG
 SPTechCon Hosted Meeting in August!

41.  Geoff Varosky
 Jornata
 Managing Consultant, Senior Architect, Senior Developer, Director of
Evangelism
 President & Co-Founder Boston Area SharePoint Users Group
 Co-Organizer SharePoint Saturday Boston
 Recent Awards
 Top 25 2012 Harmon.ie Online Community Influencer
 Top 50 2012 KnowledgeLake Community Influencer
 Blog – www.SharePointYankee.com
 Email – geoff@varosky.com
 Twitter – @gvaro