Planning for user access
The greatest challenge of the design was planning for the various classes of users. Fortunately, I discovered some friendly clip art on Office Online to represent our users and this helped us to visualize our task. Planning for user access involves coordinating zones across the server farm and planning for authentication.
A key design choice is to configure remote employee access through the Default zone. In fact, the Default zone requires the greatest amount of consideration. Office SharePoint Server 2007 places the following requirements on how the Default zone is configured:
§ When a user request cannot be associated with a zone, the authentication and policies of the Default zone are applied. Consequently, the Default zone must be the most secure zone.
§ The index component requires access to content through at least one zone to crawl content. By default, the index component uses NTLM authentication and attempts to index content through the default zone first. There are ways to work around this behavior. You can find more information in the supporting article. Also see Plan authentication methods.
§ Administrative e-mail is sent with links from the Default zone. These include e-mail to owners of sites that are approaching quota limits. Consequently, users who receive these types of e-mails and alerts must be able to access links through the Default zone. This is especially important for site owners.
§ Host-named site collections are only available through the Default zone. All users who are intended to access host-named site collections must have access through the Default zone.
In the model, the Default zone is used for remote employee access for the following reasons:
§ Employees can access links in administrative e-mail regardless of where they are located.
§ Internal server names and URLs are protected from being exposed when the zone associated with a user request cannot be determined. Because the Default zone is already configured for remote employees, URLs do not expose sensitive data when this zone is applied.
Another key design choice is the configuration of authentication for remote employees. The article contrasts two choices:
§ Forms authentication using an LDAP provider to authenticate against the internal Active Directory domain controller. The caveat to this choice is this: if users connect to sites both internally and remotely, two different user accounts are created in Office SharePoint Server 2007. That is, one account represents the user when using Windows authentication and a second account represents the user when using forms authentication. Consequently, both accounts require permissions to sites and documents.
§ Integrated Windows authentication using NTLM. This method relies on using ISA Server 2006 to authenticate users and then to send the user credentials to Office SharePoint Server 2007. ISA Server uses forms authentication to authenticate users against the Active Directory environment. ISA then forwards the Windows credentials to Office SharePoint Server. This approach does not result in two different accounts for users who work both internally and remotely, greatly simplifying permissions management. This method also simplifies the management of crawl rules as the default crawl behavior works with this configuration.
After planning for the Default zone and remote employee authentication, planning for the rest of the zones and authentication methods is straightforward. In the sample design, partners access sites using forms authentication. This requires a separate directory and provider, such as a Microsoft SQL Server database and provider, to store partner accounts in the perimeter network. The advantages of this approach are that you can manage partner accounts separately, and you do not need to add partner accounts to the internal employee directory. Authentication for the remaining classes of users is predictable.
The final design point to emphasize when planning for user access
in reference to:
Microsoft SharePoint Team Blog : Investing in Logical Architecture Design Samples (
view on Google Sidewiki)