In today’s complex market place of corporate partnerships and relationships, sharing information is pertinent to ensuring that business operations are conducted in a secure computing environment with trusted entities being provided access to protected information. In this session, Dan and Scott will discuss the basics of authentication and authorization in relation to the SharePoint platform. Further, we will be discussing the technical underpinnings of the SharePoint platform’s processing of a user’s identity dependent on identity provider and authorization settings. As a part of this session we will demonstrate different authentication and authorization configurations that are common place in today’s business settings to include when to use: • Integrated Windows Authentication • Forms Based Authentication using SQL Server • ADFS as a Trusted Identity Provider • Threat Management Gateway with Kerberos Constrained Delegation using client certs After attending this session, attendees will have a better grasp of the configuration complexities involved with each scenario as well as the user experience impacts based on the path taken.

2. who am I?
Dan
Usher
#bb

3. what about this guy?
#ct

5. about you

6. housekeeping
• Phones silenced, phasers set to stun
• Ask questions
• Please remember to turn in your filled out
bingo cards and event evaluations for prizes.
• SharePint is sponsored by Slalom at Whiskey
Trader (Between 55th and 56th on 6th Avenue).
• Follow SharePoint Saturday New York City on
Twitter @spsnyc and hashtag #spsnyc
• Do not feed Scott donuts…
#bb

7. #bb

8. Security

9. http://xkcd.com/1240/
#ct

10. #ct

11. #bb

12. #ct

13. #bb

14. #bb

15. #ct

16. • The act of authorizing.
• Permission or power granted by an authority;
•
•
•
•
sanction.
To give authority or official power to.
To give authority for; formally sanction (an act
or proceeding).
To establish by authority or usage.
Sometimes we call it AuthZ.
#ct

18. #ct

19. #bb

20. #bb

21. #bb

22. http://go.spdan.com/cba
#bb

23. #ct

24. #ct

25. #bb

26. #ct
http://go.spdan.com/claimsencoding

27. #bb
Source: http://go.spdan.com/iisauth
ASP.NET Authentication

28. Identity Provider
Security Token Service
aka IP-STS
1.
2.
3.
4.
5.
6.
7.
8.
SharePoint 2010
aka RP
Resource Requested
AuthN Request / Redirect
AuthN Request
Security Token
Security Token Request
Service Token
Resource Request w/Service Token
Resource Sent
#bb

30. #bb

32. #ct

33. #ct

34. #ct

35. #ct

36. #bb

37. #bb

38. #bb

39. https://sts.domain.com
#ct

40. #ct

41. #bb

42. #bb

43. #bb

44. Web Application / Site Collection
Secured Site / Site Collection / Content
Anonymous
Authentication
Content Repository
Is In Site Group?
Content
Does user have claim attribute?
#ct

45. #ct

46. Real World

47. #bb

48. #ct

50. Usher_Daniel@bah.com
@binarybrewery
www.sharepointdan.com
scott.hoag@appliedis.com
@ciphertxt
http://psconfig.com