Thủ thuật Sharepoint 2010 part 37 potx

232  CHAPTER 9 claims-Based aUtheNticatioN Digest  Certificate  NTLM  Kerberos  Claims-Based SharePoint Server 2010 CBA enables authentication using Windows Integrated security and non-Windows systems. A key concept with CBA in SharePoint 2010 is that authentication is based on an identity provider. Applications trust this provider because they are configured to utilize the provider. The beauty of the system is that any provider that meets specific Internet security standards can be used. These standards include WS-Security, WS-SecurityPolicy, WS-Trust and WS-Federation. Therefore companies have the flexibility to choose their provider, and as long as it’s compliant with these standards it will be supported by SharePoint. CBA supports three different authentication pro- viders out of the box: Windows Authentication  — This includes all the same authentication methods that CMA supports, as listed above. Forms-Based Authentication (FBA)  — These methods include LDAP, database or custom membership, and role providers. Note that FBA is only available when you use claims-based authentication. SAML Token-Based Authentication  — These include ADFS 2.0, Windows Live ID, and third-party providers. CREATING CLAIMSBASED WEB APPLICATIONS The following instructions walk you through the process of creating a claims-enabled web applica- tion. You will also configure the application to allow anonymous access. Finally, you will add FBA to the application so that you have a dual authentication configuration. Configuring CBA with Windows Authentication Begin by configuring CBA with Windows Authentication: 1. Create a new web application using CBA. The process for creating a new web application was discussed in detail in Chapter 4, so it isn’t repeated here. Only the changes specific to enabling CBA are discussed. You must first enable CBA in the Authentication section of the Create New Web Application web page in Central Administration. The default is classic mode, so you will need to select claims mode. Notice that the Claims-Based Authentication option has been selected, as shown in Figure 9-1. Creating Claims-Based Web Applications  233 FIGURE 91 2. Scroll down to the Claims Authentication Types section and review the options. This section and the Sign In Page URL section are shown in Figure 9-2. Keep the default settings, which are Windows Authentication enabled and NTLM. Note that you can enable the web applica- tion to use a single URL for both Windows Authentication and Forms-Based Authentication by enabling the checkbox for both methods. This is only possible with CBA. Without CBA, you would have to create two different zones. 3. CBA may require users to log in; therefore, they may need to be redirected to a web page to enter their credentials. Do not change the default settings, which should be to use the Default Sign In Page option. Note the option to enter the URL of a custom sign in page, as shown in Figure 9-2. FIGURE 92 234  CHAPTER 9 claims-Based aUtheNticatioN 4. Ensure that all the other settings are configured according to your specific interests. When finished, click OK. Once the web application has been created, the Application Created web page will be displayed, as shown in Figure 9-3. FIGURE 93 5. Verify the Authentication settings for the web application by browsing to the Web Applications Management web page, clicking your specific claims-enabled web application, and then click- ing the Authentication Providers button in the Ribbon. The Authentication Providers dialog, shown in Figure 9-4, should be displayed. FIGURE 94 6. Create a new site collection within this new web application using your own preferences. You will be directed to the Top-Level Site Successfully Created web page once the process is complete. Browse to your new site collection’s top-level site. This completes the process. You may need to create a new DNS entry if you used host headers for your web application, and you may need to issue the following command, ipconfig /flushdns, after creating the DNS entry. Creating Claims-Based Web Applications  235 Configuring Anonymous Access You can configure your CBA web application to allow anonymous access using the following steps. These steps are similar to those used for SharePoint 2007: 1. Under Application Management in Central Administration, select Manage web applications. 2. Select the specific web application to be enabled and click the Authentication Providers but- ton on the Ribbon. 3. Click the Default link in the Authentication Providers dialog. This should display the Edit Authentication dialog, shown in Figure 9-5. FIGURE 95 4. Enable anonymous access by clicking inside the Enable anonymous access checkbox in the Anonymous Access section. Click the Save button. Close the Authentication Providers dialog. 5. Return to the Web Applications Management page. With your web application selected, click the Anonymous Policy button in the Ribbon. This will take you to the Anonymous Access Restrictions dialog, shown in Figure 9-6. In the Zones drop-down box, select (All Zones); and in the Permissions section, select None - No Policy. These should be the default conditions. 236  CHAPTER 9 claims-Based aUtheNticatioN FIGURE 96 6. Browse to the site collection you created previously in the claims-enabled web application. From the Site Settings page, click the Site Permissions link in the Users and Permissions section. The Permissions page is shown in Figure 9-7. FIGURE 97 7. Click the Anonymous Access button in the Ribbon to display the Anonymous Access dialog, shown in Figure 9-8. 8. Select the Entire Web site option or the Lists and Libraries option, depending on what you wish to provide access to. For this exercise, select Entire Web site. When finished, click OK. Creating Claims-Based Web Applications  237 You should see Anonymous Users added to the list of users and groups on the Permissions page, as shown in Figure 9-9. This completes the configuration. FIGURE 98 FIGURE 99 Converting to CBA from CMA You can convert a web application that has been configured to use CMA to use CBA, but only by using PowerShell. Once you convert the web application to use CBA, you cannot return to CMA. The following PowerShell commands will complete this conversion: $ConvertApp = get-spwebapplication “http://<web application name>” $ConvertApp.useclaimsauthentication = “True” $ConvertApp.Update() 238  CHAPTER 9 claims-Based aUtheNticatioN Configuring Forms-Based Authentication Using the following instructions, you will enable FBA for your existing claims-enabled website so that both Windows Integrated and FBA are being used. Enable FBA Follow these steps to enable FBA: 1. Navigate to the Web Applications Management page, select your claims-enabled web appli- cation and click on the Authentication Providers button in the Ribbon. 2. Click the Default link in the Authentication Providers dialog window. Scroll down in Edit Authentication dialog until you reach the Claims Authentication Types section. Enable FBA and add names for the ASP.NET membership provider and the role manager. You can choose your own names or use SQLMembershipProvider and SQLRoleManager. Click Save when you are done and close the Authentication Providers dialog. Remember the names that you have chosen because you will need to refer to them in the web.config file. Also, keep in mind that these names are case sensitive. Install and Configure the SQL Server Database The next step is to create and configure a SQL Server database that will be used for FBA: 1. Open Windows Explorer and navigate to C:\Windows\Microsoft .Net\Framework64\ v2.0.50727 . Locate the aspnet_regsql.exe application and execute it. This will open the ASP.NET SQL Server Setup wizard, shown in Figure 9-10. Click the Next button. FIGURE 910 . aUtheNticatioN Digest  Certificate  NTLM  Kerberos  Claims-Based SharePoint Server 2010 CBA enables authentication using Windows Integrated security and non-Windows systems. A key concept with CBA in SharePoint 2010 is that authentication. choose their provider, and as long as it’s compliant with these standards it will be supported by SharePoint. CBA supports three different authentication pro- viders out of the box: Windows Authentication. authentication. SAML Token-Based Authentication  — These include ADFS 2.0, Windows Live ID, and third-party providers. CREATING CLAIMSBASED WEB APPLICATIONS The following instructions walk you through