SharePoint in the Extranet Joel Oleson
- 1. SharePoint in the Extranet Joel Oleson Technologist Microsoft Corporation OFF305
- 2. Agenda Side by Side Comparison of 3 SharePoint Internet Facing Deployments IT Windows SharePoint Services (WSS) Extranet Deployment Intellectual Capital Exchange (ICE) Hosted Environment – Spsites.microsoft.com Issues & Challenges SP2 & Windows R2 Extranet Enhancements Resources Q/A
- 3. Side by Side Comparison Microsoft’s SharePoint Internet Enabled Deployments
- 4. Service Comparison Partner Account Access SPS Search Topics & Areas Existing AD Accounts Custom Web Services ADFS AD Account Creation Mode Site Directory Portal Hosting My Site Hosting WSS Hosting SPSites ICE IT Extranet
- 5. Spsites Topology https://spsites.microsoft.com 10,000’s WSS Sites 10,000’s My Sites Site Directory Profiles
- 6. ICE Topology ICE http://ice https://ice.partners.extranet.microsoft.com Topics & Areas My ICE Sub Areas Web Service
- 7. IT WSS Extranet Topology Dublin Singapore Redmond Americas Team https://*.team.partners.extranet.microsoft.com https://*.eteam.partners.extranet.microsoft.com https://*.spteam.partners.extranet.microsoft.com Asia/South Pacific SPTeam Europe ETeam
- 8. Hardware 3 Web 2 Search 1 Index/Job 2 WSS Web 2 Web/Search 1 Index/Job SQL ISA 2004/Web Publishing Load Balancers Load Balancers IT WSS Extranet MMS SPSites ICE (A/P) SQL Cluster (A/P) SQL Cluster
- 9. 3 Extranet Deployments Business & IT Requirements Infrastructure/Architecture Solution Add-ons Workarounds Challenges
- 10. IT WSS Extranet Deployment
- 11. IT WSS Extranet – Requirements Scalable Hosting WSS Business Easy to Collaborate with Partners Use Existing Internal Accounts Scalable & Highly Available Accounts for partner collaboration IT & Security Secure Collaboration - 2 Factor Auth No Anonymous Access Web Servers: IP masked, no ICMP Only SSL port allowed (Admin port blocked) No Corp Resources
- 12. IT Extranet WSS Solution Auth: Basic over SSL Accounts: One way NTLM trust between partner domain and corporate child domains Partner account provisioning & management system: Use Existing ( https://www.partners.extranet.microsoft.com ) Leverage Existing Extranet Onboarding process Hardware: Stand Alone Deployment in DMZ
- 14. ICE Deployment
- 15. ICE Requirements Business Transparent Login Web Single Sign On (not SPS SSO) Use existing NT accounts Hosted SharePoint like it is on Corp @ Home and on the Go IT & Security Firewalled (DMZ) Intrusion Detection IPSec between Corporate Clients & Managed Servers 128 bit SSL Separate Forest from Corporate
- 17. MMS Requirements Business Transparent Login Use existing NT accounts Hosted SharePoint like it is on Corp @ Home and on the Go IT & Security Firewalled (DMZ) Intrusion Detection 128 bit SSL Separate Forest from Corp and Other Hosted Customers
- 19. Key Issues for MS Extranet or Internet Enabled Deployments Four Primary Challenges Security Cross Forest Issues Account Management Client Facing Issues
- 20. Security Security team wants 2 factor authentication Security wanted Digest authentication Security wanted Forms authentication Security then wanted token based auth Services/App Pools need to run with account in the same domain (MMS) Password service account restrictions make maintenance painful
- 21. Cross Forest Issues (Spsites) Manage Users Address book fails to work when email address & NT user name do not match Lookups fail when User domain does not trust resource domain and Trust is at the forest level (works with domain (NTLM) trust) Display Name and Email address will not be populated Requires user to know NT account or NT Security Group Document Workspace/Meeting Workspace creation from Outlook/Office doesn’t permission other users (lookup failure)
- 22. Account Management (IT WSS/ICE) AD is the account repository (live or die by it) Painful Process for managing partner accounts – account creation and password management (listen to our story) Active Directory Account Creation Mode Only for Windows SharePoint Services Cannot coexist with pre-existing accounts
- 23. Client Facing Issues Web capture web part doesn’t work with SSL Mixed content for online web parts (HTTP vs. HTTPS) Web Folder mixed content prompt Transparent Login requires Intranet Zone or special IE security URL Length (256 & 260) Internal vs. External URL path issues (Use Alternate Access (Alert links, invalid extranet links, confusion)
- 24. Changes in WSS/SPS SP2 & R2? Windows 2003 R2 & ADFS
- 25. WSS SP2/SPS SP2 Enhancements Support for IP-bound virtual servers * Support for Advanced Extranet Configurations SSL Termination Host Header Modification Port Translation Kerberos enabled by default on single box new installation WSS running on ASP.NET 2.0 (Whidbey) Support for Windows x64 editions Support for SQL 2005 http://www.microsoft.com/downloads/details.aspx?FamilyId=ABBA20F2-3625-4C9C-A412-AB9BBEBDB5E8&displaylang=en * Applies only to Non Scalable Hosting Mode Configurations or No support for Farms with Multiple Hostnames on a single IIS virtual server.
- 26. Ways to Support SSL on Multiple Portals or WSS IIS Web Sites X X X SSL + Reverse Proxy (Terminated at SharePoint i.e. ISA link/port translation) X SSL + Reverse Proxy (Terminated at Reverse Proxy X SSL + Port Translation X X X SSL on alternate ports for Multiple Virtual Servers X X X SSL w/ Wildcard Host Header DNS W2K3 SP1* W2K3 SP1* SSL + Host Headers X SSL + IP Bound Virtual Server X X X SSL + Single IIS Virtual Server per server SP2 SP1 RTM Configuration
- 27. ADFS for Windows 2003 R2 & WSS Windows Server 2003 R2 servers configured as federation servers can provide access to Windows SharePoint Services sites over the Internet Your network and the network in your partner organization both need to support ADFS Shadow accounts setup in the resource partner if no forest trust exists between both partner organizations with federation trust between both partner organizations WSS Web server configured with R2 and has SSL certificate ADFS Web Service Agent on the Web server hosting Windows SharePoint Services Windows SharePoint Services site users in the account partner organization setup with permissions http://download.microsoft.com/download/9/3/e/93eff406-5dd6-442d-bedd-082ef29a6d22/ADFSStepbyStep.doc Be aware of SOAP issues (DWS & MWS Creation, FPEdit, Excel/Outlook Export & Import)
- 28. Session Summary Security is strong but getting stronger and more flexible Workarounds are available for most issues Windows R2, WSS SP2, SPS SP2 – Remove deployment blockers
- 29. Where to find Joel … Talks – ATE Tuesday 11:30-12:45 C&T SharePoint Gone Wrong – How to Recover 13:00-14:00 IW SharePoint Demo Station 13:00-14:00 Panel: Life at the Bleeding Edge 15:00-16:00 IT ATE Booth 7 18:30-20:00 IW SharePoint Demo Station Wednesday 9:45-11:00 C&T Windows File Servers and SharePoint – Clarity 14:00-15:15 C&T SharePoint Gone Wrong – How to Recover II 15:30-16:45 Breakout - Building SharePoint for Maximum Scale 17:00-18:00 IT ATE Booth 7 Thursday 10:00-11:00 IW SharePoint Demo Station 13:00-14:00 Panel: Enabling the New World of Work 14:00-15:30 SharePoint Extranets 15:30-16:30 IT ATE Booth 7
- 30. Where to get more on … How Microsoft Does IT “ Ask The Experts” – Booth 7 Come find us in the Sponsors & Exhibition Hall Enter our daily prize draw and win X-box games & a memory mouse Delegate Networking Schedule a 1:1 with any of our IT speakers and experts On the Web Visit www.microsoft.com/ itshowcase IT Showcase DVD The very latest in white papers, presentations and Webcasts, collect one HERE or from the ATE – Booth 7
- 31. Community Resources Community Resources http://www.microsoft.com/communities/default.mspx Most Valuable Professional (MVP) http://www.microsoft.com/communities/mvp Newsgroups Converse online with Microsoft Newsgroups, including Worldwide http://communities2.microsoft.com/communities/newsgroups/en-us/default.aspx User Groups - Meet and learn with your peers http://www.microsoft.com/communities/usergroups/default.mspx
- 32. Microsoft Learning Resources Come and talk to Microsoft Learning to find out more about developing your skills, you can kind us in the ‘Ask the Experts’ area Special offers on Microsoft Certification from Microsoft Learning Click here to access free Microsoft Learning Assessments http://www.microsoft.com/learning/assessment/ind/default.asp and FREE elearning for Microsoft Visual Studio 2005 and Microsoft SQL Server 2005 with free Assessments and E-Learning http://www.microsoft.com/learning/mcp/
- 34. © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.