Update 2.5.08:
http://msdn2.microsoft.com/en-us/library/bb975136.aspx
Intro article to three new articles on FBA from Microsoft. Get the other two in the margins on the left.
End Update:
http://www.andrewconnell.com/blog/articles/HowToConfigPublishingSiteWithDualAuthProvidersAndAnonAccess.aspx
(the best guide—Andrew Connell)
http://channel9.msdn.com/ShowPost.aspx?PostID=299338
http://weblog.vb-tech.com/nick/archive/2006/06/14/1617.aspx
http://www.networkworld.com/community/node/18581 (Good one)
“A few caveats about using FBA before you enable it. First, the crawler in SharePoint for indexing cannot crawl a web application that uses FBA. You must have the same content extended onto a separate web application that is configured to use Integrated Windows Authentication or Basic Authentication/SSL for this to work properly. Secondly, Office client integration can be impacted when using FBA. It is best used for scenarios where users download Office content for reading, not necessarily scenarios where they contribute to document content. This is due to limitations in the Office client software and how it handles FBA.”
The Microsoft article—including info on configuring the SSP for FBA
http://technet2.microsoft.com/Office/en-us/library/3107ebf3-2037-45f4-90b9-4200d9799b361033.mspx?mfr=true
“In the Client Integration section, under Enable Client Integration, make sure No is selected, and then click Save.
• |
If you select Yes, features that start client applications according to document types will be enabled. This option will not work correctly with some types of forms-based authentication. |
• |
If you select No, features that start client applications according to document types will be disabled. Users will have to download documents and then upload them after they make changes. |
“
http://blogs.msdn.com/sharepoint/archive/2006/08/16/configuring-multiple-authentication-providers-for-sharepoint-2007.aspx
(Configuring Multiple Authentication Providers for SharePoint 2007)
Good list of different sites with guides on this:
http://weblogs.asp.net/erobillard/archive/2007/09/07/moss-and-forms-based-authentication-the-tricks.aspx
Ok, I’ve already created http://vanlaan and https://www.vanlaans.com web apps. http://vanlaan handles Windows authentication, while https://www.vanlaans.com currently handles Windows and anonymous. I want to switch the latter to use Forms-Based Authentication.
As my first step, I want to create the ASP.NET 2.0 database to hold my user authentication information.
Here I’ve navigated to C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727 and am about to run aspnet_reqsql.exe to create this database, which will kick off a wizard:
Click Next twice on the wizard then:
I’ve named my database FBAdb and gone with defaults on the other portions.
Click Next to see the summary screen, then next again and you should see this:
Hey, it’s been created. Good times. Here’s your proof:
Now to create our single user in the database. Again, following Andrew Connell’s instructions, we’ll create a new web site project in Visual Studio 2005.
Following AC’s recommendation, I’ve gone with the following:
Click Ok.
Now, AC next instructs us to Add a web.config file. This is done by clicking Website, then Add New Item:
When we click Add New Item, we’ll see this screen, where we’ll need to select Web Configuration File:
Click Add.
This is what it looks like to start with:
We’ll replace the <connectionStrings/> portion with this:
1: <connectionStrings>
2: <add name="FBAdbSQLConnString"
3: connectionString="server=[THEMAN];database=FBAdb;
Integrated Security=SSPI;"
4: providerName="System.Data.SqlClient"
5: />
6: </connectionStrings>
So, now I’ve added it to my web.config file:
So, then I added in the following information into the web.config file under system.web:
1: <!-- membership provider -->
2: <membership defaultProvider="AcAspNetSqlMembershipProvider">
3: <providers>
4: <add name="AcAspNetSqlMembershipProvider"
5: type="System.Web.Security.SqlMembershipProvider, System.Web,
6: connectionStringName="AcSqlConnString"
Version=2.0.0.0, Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a"
7: enablePasswordRetrieval="false"
8: enablePasswordReset="true"
9: requiresQuestionAndAnswer="false"
10: applicationName="/"
11: requiresUniqueEmail="false"
12: passwordFormat="Hashed"
13: maxInvalidPasswordAttempts="5"
14: minRequiredPasswordLength="1"
15: minRequiredNonalphanumericCharacters="0"
16: passwordAttemptWindow="10"
17: passwordStrengthRegularExpression=""
18: />
19: </providers>
20: </membership>
21:
22: <!-- role provider -->
23: <roleManager enabled="true" defaultProvider="AcAspNetSqlRoleProvider">
24: <providers>
25: <add name="AcAspNetSqlRoleProvider"
26: type="System.Web.Security.SqlRoleProvider, System.Web,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
27: connectionStringName="AcSqlConnString"
28: applicationName="/"
29: />
30: </providers>
31: </roleManager>
I removed all of the numbers followed by “:”’s and changed the two connection string names to match what I used above and seemed to make it happy. Looks like this:
Then, I’ll launch the Website via Website, ASP.NET Configuration:
The site loaded thus:
Then, switch from Integrated Authentication to Forms Authentication.
When I hit the Security tab, I get this error:
“There is a problem with your selected data store. This can be caused by an invalid server name or credentials, or by insufficient permission. It can also be caused by the role manager feature not being enabled. Click the button below to be redirected to a page where you can choose a new data store.
The following message may help in diagnosing the problem: An error has occurred while establishing a connection to the server. When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)”
I changed my SQL Server 2005 Surface Area Configuration to this:
Did a reboot and then went back to the Security tab:
Same error. Huh.
Just had a thought. Realized I’d specified my server as:
connectionString="server=[THEMAN];database=FBAdb;
Gonna go take the [] out.
Wow. I must be some kind of genius:
Moving on: Click Select Authentication type
Click From the Internet, then click Done:
Select Security Tab again, then click Create User:
I’ve entered info to create user fbaadmin with a cryptic password:
And, just for fun, we’ll go look at the database in SQL Server Mgmt Studio and verify it was created there:
After Creating the user, Click the Provider tab then Select a different provider for each feature (advanced)
As you can see, the providers I specified in my web.config file, FBAAspNetSqlRoleProvider, exist here. That’s good.
Clicking test on either should provide us with following positive message:
Provider Management |
Successfully established a connection to the database. |
Now, AC’s directions have us go create a web site and site collection, then extend that web app onto another IIS web site which will have different authentication. I’ve already done that portion, with http://vanlaan as my default site and https://www.vanlaans.com extended from that site onto the Internet zone. It is this entry point that I’ll want users to use Forms-Based Authentication.
So, to add the following information into the above web sites’ web.config files:
Connection string:
<connectionStrings>
<add name="FBAdbSqlConnString"
connectionString="server=THEMAN;database=FBAdb;
 Integrated Security=SSPI;"
providerName="System.Data.SqlClient"
/>
</connectionStrings>
Membership and role provider:
<!-- membership provider -->
<membership defaultProvider="FBAAspNetSqlMembershipProvider">
<providers>
<add name="FBAAspNetSqlMembershipProvider"
type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="FBAdbSqlConnString"
enablePasswordRetrieval="false"
enablePasswordReset="true"
requiresQuestionAndAnswer="false"
applicationName="/"
requiresUniqueEmail="false"
passwordFormat="Hashed"
maxInvalidPasswordAttempts="5"
minRequiredPasswordLength="1"
minRequiredNonalphanumericCharacters="0"
passwordAttemptWindow="10"
passwordStrengthRegularExpression=""
/>
</providers>
</membership>
<!-- role provider -->
<roleManager enabled="true" defaultProvider="FBAAspNetSqlRoleProvider">
<providers>
<add name="FBAAspNetSqlRoleProvider"
type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
connectionStringName="FBAdbSqlConnString"
applicationName="/"
/>
</providers>
</roleManager>
First, I’m going to save a copy of my web.config files I’m about to edit.
Then, I’ll cut and paste the connection string portion that’s written above below the </Sharepoint> tag and above the <system.web> tag.
Again, here’s the string I used:
</SharePoint>
<connectionStrings>
<add name="FBAdbSqlConnString"
connectionString="server=THEMAN;database=FBAdb;
 Integrated Security=SSPI;"
providerName="System.Data.SqlClient"
/>
</connectionStrings>
Looks like this:
Then, we’ll add the membership and role provider language to the web.config filejust after the first <system.web> tag and above (for me) the <securityPolicy> :
Need to do the same for the web.config for https://www.vanlaans.com . Done.
Now, need to do the same for the Central Admin web app:
Here, I used Visual Studio to add the lines in:
Again, following AC’s instructions, this web.config has one small change:
<roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider">
All else was the same.
Now, to change the Authentication Provider for the Internet zone of the http://vanlaan web app, which is basically saying we’re changing the authentication for the extended web site at https://www.vanlaans.com .
Click Application Management, Authentication Providers. Make sure the correct web app is selected, then click the Internet Zone:
We’re going to select Forms, which opens up the Membership Provider name and Role Manager name fields. We’re also going to click Enable Anonymous access. Then
Membership Provider name: FBAAspNetSqlMembershipProvider
Role Manager name: FBAAspNetSqlRoleProvider
Like this:
We’ll leave Enable Client Integration unchecked, as it doesn’t work all that super with FBA.
And, after clicking ok, we go to the website (where I’ve already enabled anonymous on the site) and get this to start:
Notice I’ve still got my https: from the previous SSL application. And I’ve got the Sign In button up top right, which indicates I am in anonymously. Clicking Sign In gets me this:
Ok, now we’ll go to add the fbaadmin account we created above to the site via Site Actions, Site Settings, People and Groups. We go to add users and when I just type in fba, the following occurs:
Now, this is not exactly what I wanted to see. It doesn’t behave the same way as if we were connecting to Active Directory and it would at least give us some id’s containing that string. But, if we type in fbaadmin, the id in its entirety, we get a match.
And, as we can see, the Provider is displayed here, showing us where this id came from.
And that's my walkthrough for setting up Dual authentication on a single Sharepoint web application. Much thanks to Andrew Connell and the guys at Alachua. (Lawrence, Ian, Dave)
