Upload
njitben
View
3.952
Download
2
Embed Size (px)
DESCRIPTION
Presentation slides for SharePoint Saturday NYC 2012 (7/28/2012). By Ben Steinhauser, B&R Business Solutions. http://www.bandrsolutions.com
Citation preview
SharePoint 2010Custom Authentication Providers
Benjamin SteinhauserSharePoint Saturday NYC 2012
About Me• Benjamin J. Steinhauser• SharePoint Solutions Developer• B&R Business Solutions• BSCS, MSCS; MCP, MCTS• 10+ years as ASP.NET Application Developer• SharePoint Developer since 2001• All versions: SharePoint Portal Server 2001, Microsoft SharePoint 2003, Microsoft Office
SharePoint Server 2007, Microsoft SharePoint Server 2010, and SP2013 Preview!
• Creator of Open Source CodePlex Projects• SPCAMLQueryHelper• SPClippy• SPjQuerify• SPEasyBranding• SPClaimsBasedAuthExamples
• Presenter at SP User Groups and SharePoint Saturday Events
SP Authentication Methods
Classic Mode Authentication
Traditional Windows Authentication
NTLM, Kerberos, Basic
(-) No more FBA available when using Classic!
(+) Less confusing for simple Farms
Claims Based Authentication
New for SP2010!
Uses Windows Identity Foundation (WIF)
Everything is tokens, claims, identity provider, security token service
(+) All auth types are available
(-) not simple!
Supported Authentication Methods
• NTLM, Kerberos, Basic
Windows
• LDAP, MS SQL Server• Or, custom 3rd party ASP.NET membership and role
providers
FBA
• Uses Active Directory Federation Services (AD FS) 2.0• 3rd party identity provider
SAML token-based Auth.
What are Claims?• SharePoint Server 2010 automatically changes all accounts to claims identities,
resulting in a claims token for each user• Claims Identifiers:
• Windows: i:0#.w|domain\sAMAccountName• FBA: i:0#.f|customdbusersmp|user1
• Identity is stored in a security Token• Contains one or more claims about the user• Claims are meta-data for the user
• SharePoint Server running in Claims Mode Authentication utilizes a Security Token Service (STS)
• STS acts as an authentication gateway to SharePoint Server, supports access• Windows Integrated Authentication• Form Based Authentication• Trusted Claims Providers (TRUST).
Forms-Based Authentication Claims
• SharePoint Server redirects the client to a login page• Page authenticates the client using the ASP.NET Membership
provider• Identity is created• SPClaimsUtility.AuthenticateFormsUser()
• SharePoint Server will then translate this identity to a claims identity object.
Pre-SP2010 FBA
Login Page
User enters Username and Password, clicks “Login”
Codebehind callsMemberShip.ValidateUser()
User is Auth, Redirect:FormsAuthentication.RedirectFromLoginPage(
)
SP2010 FBA
Login Page
User enters Username and Password, clicks “Login”
Codebehind callsSPClaimsUtility.AuthenticateFormsUser(
)
STS executes code to Validate user using Membership Provider
User is Auth, Redirect
SP2010 Mixed Mode• Web Application that uses Claims Based Authentication can support
multiple modes of authentication simultaneously• Single login page for both Windows and FBA users• ***Windows Identity and FBA Identity are 2 different identities, even if
the actual identity in the background is the same***
Mixed Mode Pros/Cons
Cons
• No more transparent Auth. in an Intranet Environment• Sign in required, custom solution available here:
http://www.orbitone.com/en/blog/archive/2010/06/23/sharepoint-2010-mixed-authentication-automatic-login.aspx
• Tricky to build custom login pages for Mixed Mode• Always presented with choice for users (when there really is no choice
since have only 1 identity), can confuse non-technical users
Pros
• Only one web.config file to make changes in (per server)• Email alerts sent by SharePoint have only 1 url to manage• Sending links to documents or pages (manually or maybe using quick links) have only 1 url
DEMO #1: Mixed Mode• Default Zone• http://mixed.spdevmutts.com• Uses Windows Authentication• Uses FBA, providers:• Membership: CustomDbUsersMP• uses custom SQL Server table: CustomDbUsersLists
• No anonymous access• No custom login page
“Nice…”
FOCUS: FBA in SP2010
Membership Provider
Role Provider (Optional)
Custom Login Page/Web Part
Web.config Modifications
CODE: Membership Provider• Membership Provider (REQUIRED)• 2 built-in OOB Providers:
• LDAP/AD: ActiveDirectoryMembershipProvider• MSSQL: System.Web.Security.SqlMembershipProvider
• Custom:• .NET Class inheriting MembershipProvider base class• Must override certain functions for SharePoint:• FindUsersByEmail, FindUsersByEmail, GetAllUsers, GetUser (2 functions),
GetUserNameByEmail, ValidateUser• Can connect to any identity repository available that .NET code can
access (ex. Oracle, Facebook, Twitter, SQL Server, XML File)• Add .NET class to GAC or local web application BIN folder• Can be deployed as a solution (WSP) easily to either GAC or BIN
CODE: Role Provider• Role Provider (OPTIONAL):• 1 Built-in OOB Provider:
• MSSQL: System.Web.Security.SqlRoleProvider• LDAP/AD Role Provider available at codeproject.com
• Custom:• .NET Class inheriting RoleProvider base class• Must override certain functions for SharePoint:• GetUsersInRole, IsUserInRole, GetAllRoles, FindUsersInRole, GetRolesForUser,
RoleExists• Can connect to any identity repository available that .NET code can
access (ex. Oracle, Facebook, Twitter, SQL Server, XML File)• Add .NET class to GAC or local web application BIN folder• Can be deployed as a solution (WSP) easily to either GAC or BIN• ***Dynamic roles can be created that users can slide in and out in real
time without manual intervention by admin (ex. admin role based on a DB field)
XML: Web.config changes• 3 web.config files (at a minimum) to be changed:• Central Administration (CA)
• PeoplePickerWildcard, ConnectionStrings, Appsettings, Membership, RoleManager
• Security Token Service (STS)• ConnectionStrings, Appsettings, Membership, RoleManager
• Web Application (WA)• PeoplePickerWildcard, ConnectionStrings, Appsettings, Membership,
RoleManager
Adding User Policy• CA web.config was updated so FBA users can be added as:• Site Collection administrator• or, “Full Control” user policy to manage FBA site
• This is necessary for the first (admin) FBA user to login to SharePoint Site and assign other permissions
Typical Login Scenarios• Windows Authentication:
• Windows Popup
• FBA:• OOB Login Page (built-in)• Custom Login Page
• Anonymous access not required if login page does not use SharePoint Master Page or minimal master page• Custom Login Web Part (SharePoint Web Part or Visual Web Part)
• Added to a web part page• Anonymous access required to get to web part page
• Benefits of using Custom Login:• can take over the login process, and extend OOB with features like:
• adding a CAPTCHA• any custom code action/event (logging, automation, syncing, etc.)• custom redirecting (targeted content, 3rd party identity management)• Site Agreements, Information Policies: agreements, privacy, EULA, etc.• Multi-Factor authentication: using SMS, tokens, etc.
DEMO #2: FBA Secure• Internet Zone• http://fbasecure.spdevmutts.com• Uses FBA only, providers:• Membership: CustomDbUsersMP
• No anonymous access• Custom login page• includes a mandatory “policy agreement” before logging in
“Cool!”
DEMO #3: FBA Anonymous• Custom Zone• http://fbaanon.spdevmutts.com• Uses FBA only, providers:• Membership: CustomDbUsersMP
• Anonymous access enabled• (in CA WA settings – 2 places, and WA site settings)
• Custom login page• Custom login web part• added to a standard SharePoint web part page• includes a mandatory “policy agreement” before logging in
“Wow!”
Identities in the Cloud!• 3rd party Identity Management• Decentralized/Distributed Authentication• “One identity to rule them all”• Common Internet Implementations:• Facebook, Google, OpenID, Twitter
• OAuth: An open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications.
• Identity is known (username, email, etc.)• Password is not
OAuth Pros/Cons
PROS• Accelerate signup process: users can use existing identities, less
reluctant to create new identity• Reduce Frustration Associated with Maintaining Multiple Usernames
and Passwords• Gain Greater Control Over Your Online Identity (You control how much
personal information you choose to share)• It’s the Cloud!
CONS• No repository of users that is searchable, complicates things in SP• User Profile Synchronization is not supported: no repository of users to
sync, custom solutions will need to be built• Membership provider will be Validating User without a password?!?
Twitter API• http://dev.twitter.com• Create a new “application”• Create an access token• Take note of consumer key and secret (needed by code to sign
OAuth requests)• Configure access token rights (read/write)• Need a callback url (even though your app specifies its own)
DEMO #4: FBA and Twitter• Extranet Zone• http://twitter.spdevmutts.com• Uses FBA only, providers:• Membership: CustomTwitterMProvider• Resolves anything entered in PeoplePicker
• No anonymous access• Custom login page• redirects to Twitter to authenticate and authorize
• Custom Web Part for Tweets!
“OMG!”
Membership.ValidateUser• How to implement the ValidateUser(username, password)
without a Password?• OPTION 1: blank password/skip password evaluation:
• Can a user login using another web application’s login page? what about web services, REST, Client OM, etc?
• OPTION 2: username + salt + encryption• Custom Login page calls:
1. SPClaimsUtility.AuthenticateFormsUser(url, username, password)2. STS calls Membership.ValidateUser(username, password)3. Password = Encrypt(username + salt)
• Membership.ValidateUser(username, password):• Recreate password sent to function, by applying same algorithm to
username• compare passwords, should be same
Putting it together• Visual Studio 2010:• Empty SharePoint 2010 Project – FBAAddOns
• Providers• in GAC
• Login Pages• in layouts
• Web Parts• Feature driven
• Helper classes• in GAC
Future Considerations• SPClaims Ticket Expiration (lasts a long time by default)• User Profiles:• Either, custom sync timer job or integration with User Profile Sync
Service Application• or, handle on login
• Client application integration (MS Office 2010)• custom login page IS supported in rich clients
• Configuring Search, Alternate Access Mappings• Extending this to other Providers:• Facebook, OpenID, CAS
• SHAREPOINT 2013 PREVIEW APPS (OAuth 2.0!)
Thanks to Our Sponsors!
Thanks!• CODEPLEX PROJECT & PRESENTATION:
http://bit.ly/LR3hNc• Twitter: @njitben• Email: [email protected]• Company: http://www.bandrsolutions.com
Special Thanks to Tom Daly, Master Page Templates!http://samplev4.codeplex.com
NOW HIRING, HELP WANTED!• Business Analyst/Project Manager• Beginner SharePoint Developer