Our environment is Sharepoint 2010, with a web application created (and site collection on top), using claims based authentication. The first site is using port 881. It is using integrated windows authentication. Another web application is created, extending the first application, using port 882. This site is using Forms Based Authentication, the membership provider is System.Web.Security.ActiveDirectoryMembershipProvider, named admembers. I have turned off Client Integration on both sites.
When I login to the 881 site, on my corporate network, logged into the machine with the same domain account that sharepoint uses, I can open an Office file saved in a document library, and it subsequently opens in the appropriate Office application, without asking me login again. But, If I login to Sharepoint from a computer that is not on our network, or login to the computer with an account that is not a domain account, I get prompted again to login when openning an Office document. If I choose the option to save, it does not prompt, but if I choose open in the dialog window, I am forced to enter my domain credentials again.
When I login to the 882 site, which uses FBA, I experience the same problem. If I open an Office document, the appropriate Office application opens, and asks me for my credentials, by showing me a dialog window with the sign in page loaded. If I choose to save the file, then I am not prompted to login, and the file saves to a local folder.
I can't expect my users that are off site to login again everytime they open an Office document, like Work, Excel, Powerpoint, etc. I have tried numerous fixes, including disabling client integration, changing the browser handling mode (strict/permissive), changing internet explorer settings (for integrated windows authentication), changing the integrated windows authentication site to use basic authentication, even hacking the page using jquery to call the sharepoint javascript function that execute the "download a copy" function. None of them work: when choosing to "open" the Office document in the browser, the user has to login again, or just close the dialog window without logging in (as long as client integration for the zone is turned off).
I'm looking to get this accomplished using windows authentication or forms based authentication.
Help!
I found this answer in a similar post which seemed to fix the problem for me when I tested it. The gist of it is you need to deny the HTTP Verbs OPTIONS and PROPFIND in IIS. Having said this, I'm not an IIS guru and am not exactly sure what this means or what else it might affect. Can anyone else shed some light on this?
A bit of background, I'm using SharePoint 2010, on an FBA site.
You have the standard three use cases:
Employee intranet access
Employee remote access
Partner remote access
Employee intranet access
This normally always works out of the box, and it looks like it is working for you.
Employee remote access
The only way that i have seen this work (and i have tried many ways) is to get TMG or ISA. Basically ISA is setup in FORMS auth with SSL, it captures the auth details, and then passes them to the sharepoint server. (and other servers if you have them eg OWA for sharepoint mail web parts)
If you select the "Is private computer" option on the ISA login screen, then Office documents share the auth cookie and don't prompt for another login. I had so many problems, but as soon as i installed TMG, they all went away. I would not recommend any other approach now.
The added bonus of this method, is that remote employees are treated as the same account as the intranet user. The way you are setup with a seperate web application, means that they will be different accounts, so things like [checkout/modifiedby/createdby/personalisation] will be different accounts (though they look the same)
Partner remote access
This may never ever work on some clients (especially Vista), as IE needs to share the authentication with Office
If this is sharepoint 2010, try this.
Get-SPSecurityTokenServiceConfig
Look at your UseSessionCookies value in the output. If True, apply the powershell below.
$sts = Get-SPSecurityTokenServiceConfig
$sts.UseSessionCookies = $false
$sts.Update()
If UseSessionCookies is true, you will have to login to any docs u want to download...
Related
I have somewhat of an odd question (for me, at least).
We have some private information a department would like to place on our SharePoint farm. The problem is, this is very sensitive information, and law demands that we have a 'two-stage' login process to secure the data.
Currently, it is housed using a system that:
A) you have to login to our network (windows logon screen)
B) you have to login to the application.
Our SharePoint farm has integrated authentication enabled. Meaning, once you login to your computer in the morning, you never have to login to sharepoint as it already knows your credentials.
This is a problem for us. Can we enable some sort of custom Sharepoint login?
Will this require a new web app for the site? A new site collection only perhaps?
Thanks,
~~Kolten
What you are looking for is called forms based authentication. Sharepoint 2010 uses claims based authentication and one of the providers you can configure is forms based. Meaning they provide a user name and password.
Here is a tutorial with the steps to do, it is a relatively straight forward process. just follow all the steps.
http://blogs.technet.com/b/mahesm/archive/2010/04/07/configure-forms-based-authentication-fba-with-sharepoint-2010.aspx
If you move you site out of Intranet zone, then IE will automatically ask for credential everytime.
See this:
http://support.microsoft.com/kb/258063
Is there a way to force sharepoint 2010 to popup the dialog to ask the user for a username and password and not use the computers logged in user, if that user doesn't have access.
We need an internal sharepoint website to not use the windows credentials, since these are computers used by many people. The windows user doesn't have access to the site, so currently it shows an access denied, click here to log in as another user. We would prefer if it just asked for credentials in a more graceful manner.
There is a way to configure Internet Explorer to do this. In Internet Explorer(IE),
Go to Tools
Click Internet Options
Click on the Security tab
Click on the button labeled Custom Level.
Scroll to the very bottom of the list
Select the option labeled Prompt for user name and password.
The default option Automatic logon only in Intranet zone' is what is causing IE to send the credentials to SharePoint. This of course would force everyone to log in on that computer.
Forms Based Authentication is the answer. You can modify the Login page and even where the users credentials (username/password) are stored (e.g. a SQL database rather then AD).
Use browser other than IE to access the SharePoint site from the community computers.
I am guessing you work in a corporate environment, which would mean your computers are probably managed by your IT department and part of your domain. Because they are part of your company's AD (Active Directory), your systadmins Should be able to modify the existing policy (i say existing, because in IE, the defaults for the settings relating to logging on are by default set so that you WOULD have gotten a logon prompt, i am guessing a group policy is already in effect). If it does not exist, have your admins create one.
The setting Jeremy mentions is one option. It could also be that the site is in included in your IE's "Local Intranet Zone". If it is, or, more probable, there is a wildcard *.yourdomainname.yourdomainextension).
Use the setting mentioned by jeremy to override the default logon behavior (automatic logon) associated with sites listed in the intranet zone.
A group policy can be applied to a group of computers or all the computers in the domain. If the policy should be applied to a small group of computers only, put those computers in a separate OU (Organisation Unit) in AD and apply the policy to that OU.
What about creating a new zone, secured with FBA, for those community computers? As long as the users of the community computers are given only URL for the new zone, you should be OK.
You can create 2 registry files to turn this behavior on and off for the Internet Explorer. Use Notepad to paste the values below, ensure that Windows Registry Editor Version 5.00is the first line, and that you're appending 2 blank lines at the end of the file (press 2x Enter).
To turn it on (i.e. always ask for credentials): AlwaysAsk.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\1] "1A00"=dword:00010000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\1] "1A00"=dword:00010000
To turn it off (automatically use credentials, only ask if necessary): AutomaticLogon.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\1] "1A00"=dword:00020000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\1] "1A00"=dword:00020000
This is useful for testing, espcecially if you're a developer in a corporate environment where you can't easily change the policy settings on your PC (but you need elevated rights, i.e. you have to run it as Administrator).
Note that the 1st key is for the local machine, the 2nd key is for the current user (currently logged in), which is needed to activate it immediately.
If you need more details about the values, check out this link:
Internet Explorer security zones registry entries for advanced users
I have enabled anonymous users on the farm and on the entire site.
I also have Windows Authentication turned on.
Whenever an anonymous user attempts to view the site, they are prompted to log in.
And they get prompted to login on every single page they view.
I would like to allow users to log in via Windows Authentication, (perhaps through a special page), but anonymous users should not get prompted to put in their password ever.
Does that mean I need to switch to forms based authentication for the entire site, or is there an option in 2010 to somehow get Windows Authentication and allowing anonymous users to live harmoniously.
It could be because some of the file is not published. For ex, if master page, CSS stylesheet or any image is unpublished, it will prompt the user for login.
Make sure everything is published and it will work.
You need to see if it is anything on this path http://server/_catalogs/masterpage/Forms/AllItems.aspx
that it is not published.
You must publish everything
May be you missed some of the configuration steps .So i wish if you take a look to the following article
SP2010 Branding Tip #9 – Turn on Anonymous Access
Regards
I assume that you are using the Publishing Site Template for the public site and hence the default.aspx (the welcome page of all the subsites) is not published so you would need to start the approval workflow publish the pages and any other assets (master page, css, images etc)
You need to do some prepwork to set the site up using two web applications, both with different authentication methods. You can't run SharePoint effectively for Windows users and anonymous (or Forms based authentication) at the same time.
Essentialy:
Create your SharePoint site for internal users using Windows Authentication
Extend the site to a new site (using the same content database) but using anonymous or forms based authentication (whichever makes sense for you)
A MSDN article can be found here on this:
http://msdn.microsoft.com/en-us/library/ff648385.aspx
You can also read Andrew Connell's blog about this (he talks about Forms based authentication but you can do the same with anonymous access)
http://www.andrewconnell.com/blog/articles/HowToConfigPublishingSiteWithDualAuthProvidersAndAnonAccess.aspx
Basically you want dual authentication, Windows for one set of users and anonymous or FBA for another (and each access the site using a different URL)
Hope that helps.
After I log into my sharepoint website, I have to login everytime I access a document from the library. Is there a way to fix this?
Thanks
User Level:
If your SharePoint site always prompts for username/password on accessing it you can set your browser to not prompt
In Internet Explorer, go to Tools
Click Internet Options
add your site URL to Internet Explorers "Local Intranet Sites" section.
Open Security tab
Click Custom Level button
Scroll down to this screen and select "Automatic logon with current username and password" radio button
Click OK.
Administrator Level:
you can add your site's internal zone URL in Alternate Access Mappings section on Central Administration>Operations site, The SharePoint server always does not prompt for username/password and you can enjoy.
When using Windows Vista or Windows 7 the office tools (e.g. Word) do not look at the Local Intranet list of Internet Explorer. But they look at the following registry location:
HKEY__LOCAL__MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters\AuthForwardServerList
If your sharepoint site is located at share.myserver.com you can set the above registry entry to *.myserver.com (including the *) so that all addresses ending with myserver.com are trusted by the office applications. This will prevent the login popup box from appearing.
For more info see this microsoft article. It solved the problem for me.
Add the SharePoint site to your trusted sites or local intranet in Internet Options.
This is to do with the way Word does the request for a file It sends an anonymous request first. What solves this is setting the session cookie to be valid for a year.
Are you using AD for the Authentication ?
Are you browsing the site from same network where it is hosted or on a Different N/W ?
If in the Same new work "Add the SharePoint site to your trusted sites or local intranet in Internet Options" and in the Trusted Sites Security Custom Level , User Authentication Section select the Option Automatically Login with the Current User Name and Password.
If you are browsing from Different n/w its bit tough to get it .
I experience this every day. My local machine is on a different domain to the SharePoint server so I have to log in every time I access SharePoint with a different application. This includes IE, Word, InfoPath, etc...
There is no way I've found to avoid it as it's simply part of using Windows authentication. Saving your password can help but still shows a dialog.
There are quite a few things that could cause this and you don't give much detail on your setup in the Q to give you an answer but...
The most comprehensive article I've found for troubleshooting this is
Unwanted Authentication Prompts
This issue is familiar to me and I've previously used the upvoted solution to the problem. However, recently I discovered that using Google Chrome rather than Internet Explorer makes this problem go away!
Solution: Use Chrome.
Switching to Basic Authentication will resolve this issue at a cost of passing credentials in clear text.
Before I begin asking this question I will have to warn you that I know next to nothing about SharePoint and I'm basically learning as I go along.
Here's where I am right now:
I have a virtual pc with an instance of SharePoint and windows server 2003 running on it
I have managed to get a network adaptor set up so I can access the SharePoint instance via a web browser in the host.
I have created and published a InfoPath form to the SharePoint instance and I can view the form in a browser from my host machine.
So far everything is great, the only issue is that in order to view the SharePoint Instance or InfoPaths form in the browser I have to first login as the virtual PCs administrator. Now what I want to do is view the same InfoPath form in a mobile device.
Here's what I have done next:
On my host machine I created a Windows CE 3.5 application
in which I added a web browser control and pointed it at the hosted InfoPath form on the SharePoint instance.
Now when I run the application in a mobile emulator I get a connection error, though I do not get this error if I point the control to google, or some other site.
I now have the distinct feeling that the reason for this is that as I mentioned to access the form I needed to login using windows authentication. I tried changing the web application in IIS to allow anonymous access and not require windows authentication. While this worked the SharePoint site stated "Not authorized" so now I gather that SharePoint builds on top of windows authentication to control access to its functionality.
So finally, after all that here's my actual questions:
How do I grant access in SharePoint to specific bits of functionality for specific windows users?
For a mobile device that is not a user on the same network as the SharePoint instance how do I give it access to view the InfoPath form?
I know my questions are a little rambled but one bit issue I have with all this is I am really not sure what to ask, or how to word it. Hopefully someone has grasped what I am trying to do and help out.
To summarize: I basically want to have an emulated mobile device (on the host) access an InfoPath form served by SharePoint/Forms Server on a virtual PC image.
When you want to change authentication to SharePoint never do so by changing settings in IIS directly but go to Central Administration, Application Management, Authentication Providers. There you can set it up to use basic authentication, Forms Auth or Anonymous access.. whatever works for you.
Forms Services may have further challenges but this should at least get you a login.