HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access

This article was been updated for WSS v3 / MOSS 2007 RTM on December 11, 2006. In addition, additional information was added and changed in the section Enabling Anonymous Access when the article was updated for RTM.

Content-centric sites that are managed via a Content Management System typically have very specific requirements. The owners of the content of a content-centric site usually spend most of their time behind the company firewall and login to their corporate Active Directory. Ideally these users need to have a single-sign-on (SSO) experience where they don't have to remember a special username and password to simply login to a Content Management System to author and manage the content on the company Web site. The public-facing portion of the site needs to allow visitors to browse the site anonymously. However, there may be certain areas of the site that require the user to login. These may include premium content, registration, or an e-commerce solution. While the familiar username/password dialog is acceptable in a corporate setting, it is frowned upon on the public realm of the Internet. Therefore, many companies prefer to implement some type of forms authentication where users login using a username or email address and password to gain access to protected areas.

Web Content Management (WCM), one piece in the Enterprise Content Management (ECM) strategy included in Microsoft Office SharePoint Server (MOSS) 2007 adds the capability of hosting and managing content-centric sites to the SharePoint platform. MOSS 2007 is built on top of Windows SharePoint Services (WSS) v3 which is in turn built on top of ASP.NET 2.0. This means that WSS v3 (and MOSS 2007) have full access and utilize everything that ASP.NET 2.0 has to offer… including the pluggable authentication model. It is this pluggable authentication that I will leverage to provide multiple authentication options for a single Web site. In this article I want to demonstrate how to configure a Publishing Site (aka: WCM site) in MOSS 2007 for the previously described common scenario companies encounter with content-centric sites. The goal is to provide an experience that achieves three requirements:

Allow content owners/authors to authenticate on the site using their corporate Active Directory credentials in order to manage the Web site's content.
Allow unauthenticated, anonymous users, to browse the unrestricted areas of the Web site.
Require anonymous user to provide a friendly Web-based form to login in order to consume restricted content.

I'll demonstrate how all three goals can be achieved using MOSS 2007 and WSS v3 in this article. First I'll set up a database to store the information for users accessing the Web site from the Internet. Once that's configured, I'll create two Web applications and a Publishing Site; each Web application, or IIS Web site, will be configured for a specific type of authentication mechanism (Windows Authentication [AD] and Forms Authentication). Then I'll configure both Web applications so they can access the users and roles that will be granted rights within the site (typically read or contribute rights to protected areas of the site). Once both sites are configured to communicate with the forms authentication-based user and role store, I'll configure one Web application to allow users to sign-in and authenticate via a common Web-based form. The last step will be to configure the site for anonymous access so they can browse the site and consume the content. Finally, I'll show you how to require a login for a specific area of the site.

This article is not written as a step-by-step instruction manual on how to configure your site for anonymous access with dual authentication mechanisms. It assumes some experience with WSS v3 and MOSS 2007. While the subject of this article deals with configuring a Publishing Site (aka: Web Content Management Site), everything translates to any type of WSS v3-based site including MOSS sites.

Setting Up ASP.NET 2.0 Forms Authentication User & Role Data Store

Before we can do anything, we first need to create a database that will store all the information, credentials, roles, and users for the forms based authentication site. Then we'll add a single user to this database which we'll use for testing later. Nothing in this step has anything to do with SharePoint as its just plain ASP.NET 2.0.

Create the ASP.NET 2.0 Database

Before we can do anything else, we need to create a database that will store the users and roles. Microsoft has provided a utility, aspnet_regsql.exe, that will create this database for you. It can be found here: %windir%\Microsoft.NET\Framework\v2.0.5027. Executing this file will trigger a wizard that will walk you through creating the ASP.NET 2.0 database. I've named my database AcAspNetDb and configured it for Windows Authentication, as shown in Figure 1 below.

Figure 1 – aspnet_regsql.exe wizard (click for larger image)

Configure Membership & Role Providers

Now that our database is configured, we need to add a single user. In my opinion, the best way to do this is to create a new Web site project in Visual Studio 2005. Why? Because not only does it have an easy way to access the ASP.NET 2.0 administration Web site that will let us add users and roles, but we'll also ensure our database connection strings, membership, and role providers are correctly configured before we bring SharePoint into the equation. I'll use these same connection string and providers in the SharePoint sites later… so we have a good foundation to copy from.

Open Visual Studio 2005 and select File -> New -> Web Site. In the New Web Site dialog, select the template ASP.NET Web Site, set the location to File System. I like to put all my Web sites in the [drive]:\Inetpub directory so I'll put mine in the following directory: [drive]:\Inetpub\AC FBA Utility Site (FBA = Forms Based Authentication). The language is irrelevant so you can pick anything… we won't write a single line of code.

Figure 2 – Visual Studio 2005 New Web Site dialog

Now, add a web.config file to the site. By default, you'll see a <connectionStrings /> node within the <configuration> node. Here you want to specify a connection string to the database you just created in the previous step. For me, I'll replace the node with the following:

   1:  <connectionStrings>

   2:      <add name="AcSqlConnString"

   3:          connectionString="server=[YourSqlServerName];database=AcAspNetDB;
				Integrated Security=SSPI;"

   4:          providerName="System.Data.SqlClient"

   5:      />

   6:  </connectionStrings>

With the connection string set up, now we need to specify the membership and role providers. In this article I'm using the ASP.NET SQL membership and role providers, so I need to add the following to the web.config file, within the <system.web> node:

   1:  <!-- membership provider -->

   2:  <membership defaultProvider="AcAspNetSqlMembershipProvider">

   3:      <providers>

   4:          <add name="AcAspNetSqlMembershipProvider"

   5:              type="System.Web.Security.SqlMembershipProvider, System.Web, 
			Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

   6:              connectionStringName="AcSqlConnString"

   7:              enablePasswordRetrieval="false"

   8:              enablePasswordReset="true"

   9:              requiresQuestionAndAnswer="false"

  10:              applicationName="/"

  11:              requiresUniqueEmail="false"

  12:              passwordFormat="Hashed"

  13:              maxInvalidPasswordAttempts="5"

  14:              minRequiredPasswordLength="1"

  15:              minRequiredNonalphanumericCharacters="0"

  16:              passwordAttemptWindow="10"

  17:              passwordStrengthRegularExpression=""

  18:          />

  19:      </providers>

  20:  </membership>

21:

  22:  <!-- role provider -->

  23:  <roleManager enabled="true" defaultProvider="AcAspNetSqlRoleProvider">

  24:      <providers>

  25:          <add name="AcAspNetSqlRoleProvider"

  26:              type="System.Web.Security.SqlRoleProvider, System.Web, 
			Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

  27:              connectionStringName="AcSqlConnString"

  28:              applicationName="/"

  29:          />

  30:      </providers>

  31:  </roleManager>

There are a few things you should take note of from the above code (marked in bold). First, note the name and connectionString attribute for the providers. When you install the .NET Framework 2.0, default connection strings and providers are specified in the machine.config file (located in the %windir%\Microsoft.NET\Framework\v2.0.5027\CONFIG). You want to make sure you use unique names here and not the names that Microsoft has included as the default names in the machine.config file. If you elect to reuse their names, you'll need to explicitly remove each one by name (via the <remove /> node) or clear all predefined connection strings and providers (via the <clear /> node). To make it easy, I specified unique names, as indicated in bold.

With everything configured, launch the ASP.NET 2.0 Web administration site from within Visual Studio 2005: Website -> ASP.NET Configuration. When the site loads, the first order of business is to switch it from Integrated Authentication to Forms Authentication. To do this, select the Security link and then select the Select Authentication Type link in the Users container. If it isn't selected already, make sure From The Internet (aka: Forms Authentication) is selected and click Done.

Create A User

Next, we need to add a user that we'll later use for testing. Select Security again and then select Create User. I'm going to create a new user with the User Name of andrewconnell and Password of password. Note I don't have to enter a strong password because of some of the settings I changed in the membership provider in the code above. The E-mail address isn't important, so I'll just enter andrewconnell@foo.com and click Create User.

Finally, let's make sure the markup in our web.config file is correct for our membership and role provider. To do this, select the Provider tab and then select Select a Different Provider For Each Feature (Advanced). You should see the membership and role provider that we specified in our web.config. Selecting the Test link for either should confirm they are successfully talking to the database.

At this point, we now have our ASP.NET 2.0 user and role database store configured. More importantly we should have a good template web.config containing the connection string, membership provider and role provider settings that we can copy from when modifying the web.config files for our SharePoint sites. Now we need some Web applications to configure!

Creating Two Web Applications, One For Each Authentication Mechanism

We need some sites to configure for authentication right? I mean, that's the point of the article right? Duh!

Creating the http://extranet IIS Web site

First step is to create a new Web application just like you would any other time. From SharePoint's Central Administration Web site, select the Application Management tab, then Create or Extend Web Application and then Create a New Web Application. I'm guessing if you're reading this article, you know how to create a new Web application from here… so I'll spare the details, but I want to point out is that I specified the following:

Set the Description as SharePoint – Extranet 80
Set the Port to 80
Set the Host Header to extranet
Picked NTLM as the Authentication Provider
Specified Anonymous Access to No

After creating the Web application, I then created a new site collection in the Web application naming the site Acme and picking the Publishing Portal site template. If you're having problems and want to see exactly what I selected, you can view Figure 3 displaying the Create New Web Application page or Figure 4 displaying the Create Site Collection page.

At this point we now have a site, configured for Windows Authentication, named ACME at http://extranet. This is the site our content owners will use to authenticate using their Active Directory corporate accounts in order to add, edit, and manage the content on our Publishing site. Make sure everything is working by browsing to the http://extranet Acme site. You should see the Welcome control and the Site Actions menu in the upper right-hand corner of the page. Assuming everything is working, we have now satisfied the first goal listed in the introduction above!

Creating the http://internet IIS Web site

Now we need to extend our Web application to another IIS Web site. This is the site our anonymous, or Internet users, will use to access the site. This site will need to be available to anonymous users as well as provide a mechanism for them to authenticate against, via Forms Authentication, in order to access restricted areas of the site (such as a member's only section). To extend the Acme Web application to another IIS Web site, from SharePoint's Central Administration, select the Application Management tab, then Create or Extend Web Application and then Extend an Existing Web Application. Again, I'll spare you from the details and highlight only a few important points on this page:

Make sure you select the Web application you want to extend… in our case we want SharePoint – Extranet 80. Use the Web Application selector at the top of the page to pick the correct application.
Set the Description as SharePoint – Internet 80
Set the Port to 80
Set the Host Header to internet
Picked NTLM as the Authentication Provider
Specified Anonymous Access to No
Set the Load Balanced URL Zone to Internet

We'll enable anonymous access later.

Again, if you are having problems, you can see exactly what I selected from Figure 5. Now we have a site that we can configure for our Internet users to access anonymously and also login via Forms Authentication. However, before we do that, there are a few configuration tasks we have to do.

Configure The Web Applications To Communicate With The ASP.NET 2.0 Forms Authentication Data Store

Once you have a Web application created that will host a site, you will need to change its authentication provider to not use Windows Authentication but instead use Forms Authentication as well as configure the site so it can communicate with our user and role data store… the AcAspNetDb we created earlier. To do this, we'll use the connection string, membership provider, and role provider we created and already tested in our utility Web site's web.config file.

Configure http://extranet & http://internet

First, we'll modify the two IIS Web sites (http://extranet and http://internet) web.config files to include the connection string, membership provider, and role provider information so they can both communicate with our user and role store. It's obvious why the http://internet site would need these changes, but why make them to the http://extranet site when we're going to use it for Forms authentication? If we didn't, it would be somewhat difficult and inconvenient (but not impossible) when we needed to grant any special permissions in the Acme Web application to one of the users or roles in our data store. This way, one of our content owners can authenticate using his/her Active Directory credentials and still grant a user who will authenticate via Forms Authentication access within the site.

Open the web.config file for the http://extranet Web site, found in the following directory (if you let SharePoint specify the Web site root directory... otherwise, retrieve it from your specified path): c:\Inetpub\wwwroot\wss\VirtualDirectories\extranet80. Add the <connectionStrings> node, listed above, just after the closing </SharePoint> tag and opening <system.web> tag. Then add the membership and role provider markup, listed above, just after the opening <system.web> tag and save your changes. Do the same thing for the web.config for the http://internet Web site, found here: c:\Inetpub\wwwroot\wss\VirtualDirectories\internet80.

Configure SharePoint Central Administration

Now both Web applications are configured to communicate with the data store. There's one last step we have to do… we need to add the same information to the SharePoint's Central Administration Web site's web.config file. Why? We need to make sure the Central Administration Web site can communicate with the data store in case we want to do any security management of the users and roles in the data store such as configuring policies for the Web application. Repeat the steps above for the Central Administration's web.config which should be found here: c:\Inetpub\wwwroot\wss\VirtualDirectories\[#####]. You need to make one small change… change the defaultProvider attribute on the <roleManager> node to AspNetWindowsTokenRoleProvider. This is necessary because Central Administration still uses Windows Authentication for the role provider. The <roleManager> node for the Central Administration's web.config should look like this:

   1:  <!-- role provider -->

   2:  <roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider">

   3:      <providers>

   4:          <add name="AcAspNetSqlRoleProvider"

   5:              type="System.Web.Security.SqlRoleProvider, System.Web, 
			Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"

   6:              connectionStringName="AcSqlConnString"

   7:              applicationName="/"

   8:          />

   9:      </providers>

  10:  </roleManager>

Now we're finally ready to configure the http://internet site for Forms Authentication!

Enabling Forms Authentication On One Web Application

Flipping the switch to Forms Authentication is very simple… it's just all the prep work that's the complicated part. Browse to SharePoint's Central Administration Web site, select the Application Management tab, and then select Authentication Providers. First, ensure you are working with the correct Web application by checking the selector in the upper right-hand corner of the Authentication Providers page (as shown in Figure 6). Once you're on the correct Web application, select the Internet zone link (as shown in Figure 6).

Figure 6 – Authentication Providers page

Note that even though we've selected the http://extranet Web application, we are really modifying the http://internet IIS Web site because that's the one mapped to the Internet zone.

On the Edit Authentication page, we are going to change the Internet zone for the http://extranet Web application to the following settings:

Authentication Type: Forms
Enable Anonymous Access: checked
Membership Provider Name: AcAspNetSqlMembershipProvider
Role Manager Name: AcAspNetSqlRoleProvider

Notice that the names of the Membership Provider Name and Role Manager Name are the names of the providers we entered in the web.config's. Now you see why we had some pre-configuration work to do before we actually made the switch. Refer to Figure 7 to see all settings I selected on the Edit Authentication page.

We now have two different ways for users to get to our Acme Web application:

Via http://extranet, authenticating using Windows Authentication (using their Active Directory credentials)
Via http://internet, anonymously or authenticating using Forms Authentication

Ah.. but we're not quite finished. Even though the http://internet Web site is now configured to allow anonymous users, the Acme Web application has not been set to grant permission for anonymous users to browse the site. You can prove this by trying to browse to http://internet. You'll immediately get redirected to the default SharePoint Forms Authentication Sign In page, as shown in Figure 8.

Figure 8 – SharePoint's default Forms Authentication Sign In Page

Let's prove that the Forms Authentication is actually working with our data store. First we need to add our user to the site. To do this, browse to the http://extranet Web site, select Site Actions, then Site Settings, then People And Groups. Select the New button to add a user to the site. On the Add Users: Acme page, enter the username of the user we created previously: andrewconnell. Then click the Check Names icon (little icon with a blue check just below the Users/Groups input box… or press [CTRL]+[K]). In the Give Permission section, select Add Users To A SharePoint Group and select Acme Visitors [Read] and finally click OK. We've now granted our user access to the site.

To test, open a new browser window and browse to http://internet. You should immediately get sent to the SharePoint Sign In page. Enter the account's credentials (andrewconnell/password) and click Sign In. You'll then get signed in and redirected back to the homepage of the site. You can see you're logged in because you can now see the Welcome control in the upper right-hand corner of the site. Notice how you can't see the Site Actions menu? That's because we only have the rights assigned to Visitors, which means we can't do anything to the site but browse it.

Last step… let's open the site up for anonymous users…

Enabling Anonymous Access

In order for anonymous users to have access to the Acme Web application and browse the site, we need to turn anonymous access on. In our case though, we only want to turn anonymous access on for the external (or http://internet) site. Before we do this, we should create a new account in our ASP.NET 2.0 database that we can use as an administrative account to make changes to our external site. First, create a new account using the same process in the Setting Up ASP.NET 2.0 Forms Authentication User & Role Data Store: Create A User section above. I'm going to create this account with the following credentials:

Username: FbaAdmninistrator
Password: password

Next, we need to grant this user ownership-level rights to our http://internet site. WSS v3 introduces a new capability where we can specify a user to have full control over a site via Web Application policies. These policies trump any permission setting within the site itself. We'll use this to set a policy to grant the FbaAdministrator full control over our http://internet site. Browse to Central Administration, select the Application Management tab, then Policy for Web application under the Application Security section. Make sure you've selected the correct Web Application from the selector in the upper-right corner of the page (in our case, we want to select http://extranet). Next, select Add Users from the toolbar. On the Add Users page, select the Internet zone (because this is the zone we specified for our http://internet Web Application) and click Next. Finally, enter the user FbaAdministrator in the Choose Users step, select Full Control in the Choose Permissions step, and click Finish. Now you can login to the http://internet site and have full control over the site, just like the site owners have.

Now we can setup anonymous access for our http://internet site. To do this, browse to the http://internet Web site, login using the FbaAdministrator account we just created and configured, select Site Actions, then Site Settings, then Modify All Site Settings. On the Site Settings page, select Advanced Permissions. On the Permissions: Acme page, select Settings, and then select Anonymous Access (see Figure 9). On the Change Anonymous Access Settings: Acme page, select Entire Web Site and click Ok.

Figure 9 – Anonymous Access menu option on the Permissions Settings menu

To test, open a new browser window and browse to http://internet. You should go straight to the Web site as an anonymous user! You can tell you aren't signed in because there's a Sign In link in the upper right-hand corner of the site where the Welcome control usually is. We have now satisfied the second goal listed in the introduction above!

Configuring A Section Of the Site For Authenticated Users Only

Our last goal was to configure a section of the site so that users must be authenticated to have access to that section's, or site's, content. To do this, we'll have to go back into our site as through the http://extranet. Because the site is now set up for anonymous access, you won't automatically be signed in, so you'll have to click the Sign In link in the upper right-hand corner. Because we created the site using the Publishing Portal template, there's a subsite named Press Releases in our site collection.

Let's make it so this site requires the user to login. Select Site Actions and then Manage Content and Structure. On the Site Content and Structure page, select Press Releases from the left-hand navigation tree and then select Advanced Permissions (see Figure 10).

Figure 10 – Press Releases Advanced Permissions

Next, we'll break the permission inheritance with the parent site and then remove anonymous access to the Press Releases site. First, select Actions and then Edit Permissions. You'll be prompted to accept your changes… select OK. Next, Select Settings, then Anonymous Access, then on the Change Anonymous Access Settings page, select Nothing and click OK.

Now let's test it… open a new browser window and navigate to http://internet. Notice how the Press Releases section isn't on the horizontal navigation (see Figure 11)? Now sign in using the Sign In link in the upper right-hand corner and watch how the Press Releases section now appears since we're authenticated (see Figure 12)! We have now satisfied the third goal listed in the introduction above!

Figure 11 – Unauthenticated User With Press Releases Site Hidden

Figure 12 – Authenticated User With Press Releases Site Visible

Conclusion

In this article I have demonstrated how you can create a Publishing Site in MOSS 2007 and configure it for two types of authentication and at the same time allow anonymous users to browse the site. So where would you go from here? Some possible next steps would include creating a self-registration system for users to create their own accounts and have these accounts automatically registered on the site under a specific role so no additional management action is required by the site owners.

[Update 3/28/2007]: Make sure you check out Tony Starr's post on the Sharepoint Team Blog (part 1 & part 2). Also, as you can see from the comments on this post, many people think MySites are broken when you use FBA. Dan Attis has a great write up on how to get MySites working with FBA here. Make sure you check it out (part 1 & part 2). The issue deals with the fact you probably don't have a profile provider setup.

[Update 5/1/2008 @ 730a]: I now have a Visual How To screencast on MSDN that demonstrates this same process: http://msdn2.microsoft.com/en-us/library/cc441429.aspx

posted on Saturday, October 21, 2006 1:11 PM

Feedback

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/29/2007 11:19 PM Kevin Tunis

Andrew,
I just read your article HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access. I have a question, I have already created an internet facing site but I have specified the Anonymous Access to ‘yes’. I have also set this to a domain using a host header. Can we configure this site going forward using the steps in your article or should we start over?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/29/2007 11:33 PM AC [MVP MCMS]

Kevin - The steps I outlined above are generally not critical to follow in order. there are some steps that are precursors to others (such as modifying the web.config to add the providers before you specify the zone to use a specific provider). You should be able to move forward fom where you are, just note that your steps may not be identical to the ones I've outlined in my article.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/30/2007 12:35 PM Lee

Hi,

It works great except for one thing: it would be nice if users did not have to be added to the sql db before adding as a sharepoint user. Could you recommend an approach that I could use to implement this? Thanks a lot.

# ---------> Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/1/2007 12:45 PM Jeff Fane

Hi Andrew, First up thanks for an excellent article and a great set of interesting posts.

Couple small things:

1) Possibly the initial article had a mention of setting up host headers in DNS and local HOSTS file, however as a few people seem to be having difficulties with this (as I was) go and have a look at:

http://thesource.ofallevil.com/technet/prodtechnol/WindowsServer2003/Library/IIS/883a9544-3f70-4d46-a6df-bbadbd1fe7de.mspx?mfr=true
(gotta love the thesource.ofallevil.com :-)

2) Your article is highly regarded and mentioned by Chandima Kulathilake, Zachary Smith of Provoke Solutions in NZ who seem to be putting together an open source WSP for self-service registration...need to read more but looks and sounds great and a natural progression from here:

http://www.codeplex.com/MOSSFormsFeature/Release/ProjectReleases.aspx?ReleaseId=1702

Anyway have subscribed to your blog thanks again great article!

Cheers

Jeff Fane

PS the font is a little small even with the IE accessability features :-)

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 10/25/2006 12:01 PM josh meyer

Great article, can't wait to try this out! Thanks Andrew!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 10/31/2006 5:21 PM Jane

wow.... this post is so much.... information and detail!
Have you tried using host header with SSL yet?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/1/2006 12:08 AM AC [MVP MCMS]

Jane - No, I haven't tried it with a HH and SSL. At this point, what you see is what you get.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/2/2006 10:44 AM Teemu

Thanks, this was really helpful!!!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/8/2006 8:44 AM Jespre

I have not tested this yet, but what happens to the my site functionality of the forms authenticated users vs the AD users.
Currently my forms authenticated useres have no mysite functionality, and i cannot figure out what to do

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/9/2006 3:14 PM Vinod

Cool One. I was looking for this for a while....Thanks Adny

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/13/2006 9:59 AM Kevin

Ok......it's very good and very handy. Thing is, I want to give my users accessing by Forms authentication their own mysites.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/13/2006 3:43 PM AC [MVP MCMS]

Jespre - FBA should not impact MySites at all... no more than Windows authentication would... that's the beauty of the pluggable authentication model!

Kevin - That's fine... shouldn't be anything stopping you providing MySites with FBA.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/14/2006 12:07 AM Mike

Great article!!
How can I extend the intranet site to Intrenet zone on a DMZ server? Is it possible to extend a intranet site on a different server to public users and have forms authentication for internal users to access it without connecting to company network and import the AD logins to SQL database?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/14/2006 9:20 AM Thomas

Thank you for this very detailed and useful posting (as always ;o). I think there is a typo that might be important: In the section "Creating the http://extranet IIS Web site" you list "Anonymous access = yes", but figure 3 (the picture) displays this checkbox unchecked. Now, I've configured according to the figure (unchecked anon.acc.) and cannot seem to get anonymous access to work. My SQL/Forms auth. user is directed to the login page, no matter what I try. Logging in works fine as does everything else, so I'm wondering if that setting cannot be changed after the web app has been created? (I'm running B2TR...)

Any ideas?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/14/2006 10:08 AM AC [MVP MCMS]

Mike - Hmm... not sure, this is more of an administrative question and I'm not familiar with it. I'll do some research and repost.

Thomas - Thanks! That the image is correct... it should be anon access = no. I've updated the article. If you want to enable anymous access, then the following three things must be true: (1) the Web Application [in IIS] must permit anonymous access, (2) the site must have anonymous access turned on and the site must be available to anonymous users, and (3) to set #2, you must have a way to get on the site and enable anonymous access. Remember, when you turn on anonymous access for the default zone, you are ONLY turning it on for that site... not for the Internet zone. To turn it on, you need to grant a FBA user owner rights on the site, make sure the Internet zone allows anonymous acces (which it should if you followed the instructions in the article) and then you need to turn anonymous access on.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 11:13 AM Thomas

Thank for replying. I've started over, following your article as closely as possible, and everything works, except for having anonymous access to the Internet-zone - I still get the login screen. I have a few differences from your article: 1) I'm using the "Collaboration Portal" template for the site collection. 2) Since I don't have access to DNS, I've added the two "internet"/"extranet" to my hosts-file and then use the host headers, as you prescribe (I can browse the two sites fine this way).

Some other things I've noticed along the way:
A) There's no "test" link in my ASP .NET Configuration website (actually, there is.. but it's for the default providers, not my custom one). However, since I _can_ authenticate and lookup users, I'm sure I have the connection to the FBA DB right.
B) In the section "Enabling Anonymous Access", you start by enabling anonymous access by browsing to the http://extranet site. However, since the default zone has never been setup to allow anonymous access, the option does not appear in the site settings. I think it should be http://internet you must browse to, and then have a user with Site Owner rights to enable anon.acc. for the site - as you described in your first reply to me above. Or am I completely off the mark??!

I will dig a bit more and see if I can spot anything else, but for now, this is my status! (almost there, but no cigar!)

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 9:18 PM Wilson

Hi,

Thanks and it's a great article.

I have done everything that you mentioned but I still having problem with anonymous access.

If I used Windows Authentication Type, I have no problem accessing the site anonymously.

However, once I switch it to Forms Authentication type, it always direct me to the login page. I have checked the following:
- Authentication Provider - enable anonymous access
- IIS - Enable anonymous
- Internete Site - enable anonymous access to entire site.

I have also tried granting Everyone access to the Virtual folder but it still the same.

Any ideas?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 10:42 PM AC [MVP MCMS]

Wilson - Have you actually gone into the site and turned anonymous access on? You need it not only for the Web App, the auth provider, and the zone, but also the site needs to be configured to allow anonymous access, just like the article describes.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/15/2006 11:38 PM Wilson

Thanks Andrew.

Yes, I did turn anonymous access on thru "Advanced Permissions". But still the same...

I just read the comments from here:
http://blogs.msdn.com/sharepoint/archive/2006/08/16/configuring-multiple-authentication-providers-for-sharepoint-2007.aspx

Looks like a number of people have the same problem and someone mentioned that this is a known bug in B2TR...

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/16/2006 12:16 AM AC [MVP MCMS]

Wilson - Interesting... I guess we'll have to just test it after the RTM is available.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/16/2006 4:55 PM John Way

When I create the extranet website according to your instructions, I get an Under Construction page with the message "The site you are trying to view does not currently have a default page. It may be in the process of being upgraded and configured.
Please try this site again later. If you still experience the problem, try contacting the Web site administrator. "

Any ideas as to why I am getting this? If I leave out the host header value (extranet) then it creates the site fine.

Thanks,

John

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/16/2006 5:23 PM AC [MVP MCMS]

John - Sounds like you didn't add an entry in DNS or to your host file for the two sites. You have to have a way for your browser to find the sites... the easiest way is to use a host file... but that's only viable in a development environment.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/24/2006 5:49 AM Maciej R.

This is great article and everything is working just fine but I can't figure out how to integrate shared services (search and my sites) with the portal created as extranet (classic AD auth) and internet (forms sql auth).

Do you have any Ideha how I should apporach such task?

Best Regards
Maciej

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 11/28/2006 5:46 PM Matt Wolf

Thanks for the Great Article!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/4/2006 6:56 AM Share Pointer

Fantastic!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/11/2006 2:07 PM AC [MVP MCMS]

I just updated the article for RTM (changing only a few things) as well as adding additional information to the Enabling Anonymous Access section.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/12/2006 10:30 AM Kent

I´m a newbee to Sharepoint but so far I like what I see.
I have been searching through Internet all day for exactly what you write here - I have find a lot of articles but yours is outstanding - THANKS!
I havent tried it yet (i havent installed MOSS yet :)) so maybee this questions I answered buy itself - as I understand your solution could have anon, form login and AD users - but if the user already is logged in to the AD - will they be prompted fo login to the MOSS also?
nd anothe newbee question - If I place the MOSS in DMZ - what will be needed to be opend for the internal net to allow AD auth?
For the form login - is it possible to access any SQL user database? We have about 3000 users in our CRM system (that is MS SQL based) - could use that database intstead of the solution you suggest above?

TIA / Kent

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/12/2006 11:33 AM AC [MVP MCMS]

Kent -
First, read the article... some questions are answered (like prompting for both FBA and AD credentials... you setup two paths so they will never get both prompts, only one).

Second, nothing specific is requred for MOSS to get your users to authenticate against an internal AD from your DMZ... just typical AD configurations.

Third, yes that's totally possible. You'll just need to create a new custom membership & role provider to use that leverages your custom DB's/CRM to authenticate against.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/18/2006 12:16 PM Ricardo Machado

Hi,
Congratulatios, and thanks to share it with the rest of us.

I found a problem updating the web.config of central administration.
Please, where exactly shoul we put the <roleManeger> tag? In my atempts, after change, site generate an error message.
In my install, central web.config doesn't have this section.

Best regards.
Ricardo
P.S.: Since I'm well over 40's, these types are toooooo small...

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/18/2006 12:42 PM AC [MVP MCMS]

Ricardo - Sorry about the font... get IE7 which lets you magnify the page :). As for the <roleManager> tag, just as the article explains, you should insert it in the <system.web> tag... so you can put both of those just inside the opening <system.web> tag in all web.config's mention in this article (for the Web apps as well as Central Admin). You won't find them in any of the web.config's created automatically... hence why I said you need to add them.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/18/2006 10:42 PM Ricardo Machado

Hi,
That's done.

another Hi,
Thank you very much for your kind answer.
Trying not to go away from the scope of this article, I would like to ask how the IIS IP’s configuration interact with this site.
I’m sending a link for a doc with the screen shots that illustrate my question, if you could be so kind and spare a few minutes to take a look at it.
The problem is that after all, the ‘http://extranet’ site doesn’t show up, but others sites do. Could you give me a clue of what is happening? Is something with the IP’s settings in the IIS?
Best regards.
Ricardo

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/19/2006 6:02 AM Ricardo Machado

Hi,
Sorry if I’m here again…
After introduce the <roleManager> tag in central web.config, site start to give an error:
“connection 'AcSqlConnString' was not found in application configuration or connection sequence is empty”
Please, hot to work around this?
Thanks in advance.
Ricardo

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/19/2006 9:25 AM AC [MVP MCMS]

Ricardo - For your IIS config issues, I make changes to my HOSTS file locally for testing, then specify a host header in the creation of my web application in the steps outlined in this document. As for the connection string error, you didn't follow the article closely. It explicitly states just after Figure 2 that you need to add a connection string section to all the web.config's. Please reread the article.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/19/2006 10:59 AM DavidS

I'm wondering if anyone has seen this before.
I've got a site running as described above, yet when I publish the main site collection, anonymous access does not seem to work anymore.

Has anyone seen this before?

Thanks,
David

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/21/2006 2:43 PM AndyA

Hi, I wondering if anyone has experienced a problem when trying to "Add Users To SharePoint" Group. My issue is once I get to this step, Sharepoint is unable to see users from the database. Instead it stays in the original domain and looks for users (therefore I can't add the user andrewconell).

Since your example works for RTM, I was wondering could there be a problem with my Sharepoint setup?

Also maybe is there anything special about how you're setting up sharepoint (Enterprise or Standard)?

Thanks,
Andy

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/21/2006 4:27 PM AC [MVP MCMS]

AndyA - I don't think you'll have any issues with the version (Enterprise vs. Standard). First thing I'd check is ot veryify all your web.configs are correct because if it can't see the providers, it can't access the stores.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/21/2006 6:32 PM AndyA

Thanks for your help AC. Actually, I found that the app pool user I used for my site didn't have permission to access the database that was created in SQL, and that was causing the problem.

Cheers,
Andy

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/22/2006 10:11 AM Luca

Thanks for this great article.
As pointed out in conclusion of it, i have to create "a self-registration system for users to create their own accounts and have these accounts automatically registered on the site under a specific role".
My idea is to customize the defaut "login.aspx" page inserting:
1) a "CreateUserWizard" asp.net control, that add a new user in the database
2) a code handler for the "CreatedUser" event that add the user to the site
In your opinion, is it a correct approach?
In particular, about the point #2, how i have to write the code? I have to "impersonate" an other user (owner of the site)?
Notice that in my situation i have not enabled anonymous access.

Thanks very much,
Luca

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/23/2006 1:29 AM AC [MVP MCMS]

Luca - That's definatley one approach. However, I'd change step 2 to be "add user to a specific role in my ASP.NET 2.0 role provider, then assign that role to a specific SharePoint Group." That way, you manage ASP.NET 2.0 roles, and your users are just automatically added to those roles. Nothing to impersonate. This is the approach I'm taking (but I'm building Web Parts, not customizing the login page).

# re: MySite service link not available after configuring for Forms Authentication. 12/25/2006 4:01 AM

Thanks much for detailed steps. I did successfully configure Forms Auth. on my site, however I need to provide MySite feature to the portal users. When the site was running on Windows auth. MySite link was available, however after configuring for Forms auth. The link dissapeared. I am not able to get the link back. I have added the ASPNET user created, as the site collection administrator. Also I have changed the SSP (Share d Service Provider) auth mode also to Forms and made the ASPNET user as the site collection admin for SSP site as well.

Any ideas how can get MySite working in Forms authentication.

Thanks much
Shekhar

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 12/28/2006 12:56 AM Shekhar

HI Anndew i have probelm working of Anonymous Access with Audiances enabled web part. To Summarize

I have been playing with MOSS 2007 RTM and have a site
configured with anonymous access enabled to the entire site. This works
great and whenever a user hits the site, a guest view is displayed and
if they wish to take advantage of personalization, the "sign-in" button
is present to kickoff the authentication process. However, on the guest
page, whenever audience targetting is enabled on a webpart container or
for a particular piece of content within a list, SharePoint initiates an
authentication request. This is not desireable behavior. If SharePoint
is unable to ascertain whether a user belongs to an audience (i.e
anonymous users) then one would expect the webpart or content to simply
not be visible on the page... in guest view. Regardless, SharePoint is
forcing the user to login. This behavior is consistent wether one uses
forms or Windows based authentication....anyone know if its possible to
influence this behavior? I really don't want to have to maintain two
separate sites...

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/4/2007 1:02 AM John

I'm with Shekhar on this. The MySite link has disappeared in my FBA sharepoint site. Any ideas how to make it reappear?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/10/2007 11:33 PM ben

Thanks for the article, i followed all the instructions i believe - but when i go to login i get an "Unknown error". Any ideas - anyone else getting this - the error gives no help at all

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 9:29 AM AC [MVP MCMS]

Ben - No way to tell what's wrong with that error. Turn off custom errors and turn on the call stack in the site's web.config to have the real exception be shown on the YSOD.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 10:57 AM Paul Chavez

Hi Andrew,

Great article and I love following your blog.
I'm working in my first MOSS installation and I'm having trouble following your instructions.

I've deviated from your example slightly because I don't need the AD extranet (at least for now). I am trying to configure the Intranet example with some anonymously accessible content and some protected content. Unfortunately, I can't authenticate any user's through membership services.

I'm up to the Enabling Anonymous Access step. I've added my connection string, membership provider and roler provider to web.config's for the site and the central administration. But, I'm having trouble authenticating against my SQL datastore (standard ASPNET Membership Services).

When I try to add a new user to a Web Application Policy, the page can't find the user. When I navigate to the site directly, I can't authenticate and get past the login page.

I have a separate ASPNET 2.0 site setup with the same configuration, like you did in the configure membership step. I can successfully access the membership store from that site.

I'm rather lost at this point, so any assistance you can offer is greatly appreciated.

P.S. What is a PeoplePicker? Should I update it on the Central Admin site to reference my membership provider or keep the original configuration? I've tried both ways to no avail.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 11:20 AM Paul Chavez

My bad - Yippee!

I had miskeyed the name of the membership and role providers on the previous step (Enabling Forms Authentication).

After correcting the provider names, I can add my administrative user to the policy and login.

Now onto the next step!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 11:28 AM AC [MVP MCMS]

Paul - Good to see you got it working!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 1:18 PM Chris Green

Andrew,

Thank you for publishing such a great article. I have my sharepoint up and running with no problems.

I have a question concerning customized web parts. Do you have to deploy them to both sites? I loaded one on extranet and it did not work on internet till I loaded it there.

Thanks,
Chris

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/11/2007 3:09 PM AC [MVP MCMS]

Chris - that's correct... you will need to deploy them to all Web applications for the site. However, if you use SharePoint solutions (*.WSP files), SharePoint will automatically deploy them to all the Web applications for you.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/12/2007 10:55 AM Willie Stylez

GREAT INSTRUCTIONS!!! They worked PERFECTLY! Now for my question; is it possible to mix authentication providers in Sharepoint? Essentially, I want to allow my Active Directory users to access the External URL, but using their Active Directory login and maintaining their internal rights. Any thoughts and if so, do you know where I can find instructions on how to accomplish this feat?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/12/2007 11:12 AM AC [MVP MCMS]

Willie - Thanks! I've never tried mixed auth providers, but if you can get it to work in a vanilla ASP.NET 2.0 site, it should work in WSS/MOSS. So, I'd look to non-SharePoint resources for this (as I bet you'll have better luck finding answers since WSS v3/MOSS 2007 hasn't been around as long as ASP.NET 2.0 and ASP.NET 2.0's install base is much broader).

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/15/2007 6:36 PM JasonG

Great article! I am almost there but ran into a similar problem posted above by AndyA. I couldn't get Sharepoint to resolve the user I created in the SQL DB until I had given the App Pool account adequate permissions.

My new problem happened when I went to Central Admin to give the FbaAdmin account right through policy. Central Admin can't resolve any user that's in the SQL DB. I double-checked my web.config and the App Pool account and all seems right. Any ideas????

Thanks,
Jason

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/16/2007 12:46 AM AC [MVP MCMS]

JasonG - As you've seen by the comments, the most common problem people are hitting (and in real life work with my customers) are issues within the web.config's. In your case, this is Central Admin. Verify the membership provider stuff is correct, and also verify you're pointing to the correct connection strings. Finally, make sure your provider & connection string names are unique... another common problem is using the names of similar ones you'll find in machine.config.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/18/2007 1:29 PM DavidC

Hi Andrew,
Thanks for this great article. But I have a problem :
the Press Releases section now appears since we're authenticated. but, no matter what I do, no one has any access to the actual content. (Error: Access Denied ).
I change the permission (full access for login "andrewconnell") and i have the same problem.
I remove this user in the site and I Go to the central admin, add this user (in internet zone) and select "read". There is no problem.
But this solution is not good for me. I do not want to give, for the "FbaAdmninistrator" profile, accesses to the central admin, to add users.

Please help me.
(excuse me for my poor english language)

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/18/2007 6:54 PM Chris Green

Andrew,

Thank you for the response to my web part question...

Working great!

I do have a problem resolving roles created in my RoleProvider. Shouldn't I be able to add roles as a group? I added a role "registeredUser" but through sharepoint, it does not resolve. Users are resolving excellently. I went through all the web configs and everything is setup correctly.

Thanks,
Chris

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/19/2007 9:07 AM AC [MVP MCMS]

DavidC - First, my recommendation to grant the FBAAdministrator user full control in the Policy for Web Apps is not a recommendation on how you should add users to your sites. That's just for a single user account that gives you full admin rights to your FBA site. For adding other users, I'd definately add users within the People & Groups link within Site Settings within the FBA site. As for your other problem, I'm sorry, but I've tested exactly what you describe and it should be working. I'd double check everything and make sure you are working on the FBA site and not the Windows site.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/19/2007 9:10 AM AC [MVP MCMS]

Chris - There's an issue (not a bug) where the roles won't resolve when you browse or search for them in the people picker. You have type the role in exactly in the input box and then click the Check Names icon or press CTRL+K to resolve it.

If its still not showing up, it doesn't sound like your (1) your role provider is configured correctly in the web.config (which you can verify using the utility site created in the first part of my particle) OR (2) you don't have the zone configured to use the right role provider within the AAM link in Central Administration.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/19/2007 5:51 PM MarcB

Hi everyone,

nice instrucitons. I am sure they work. But what I am trying to do is to use AD accounts to use forms authentication. What I need to do is direct users to a disclaimer page which they have to accept BEFORE they login and ideally this page should appear in SharePoint. I don't want to create another user database. Instead I would like to use AD entirely.
How would that be possible?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/20/2007 10:29 AM AC [MVP MCMS]

MarcB - You need to create your own authentication provider. Your provider would then authenticate against AD instead of the FBA database as I explain in this article. All your custom requirements would then be incorporated in your custom provider. This is way outside the scope of this article, hence why you didn't see me cover it.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 1/23/2007 7:35 PM Chris Green

Andrew,

I found out what was causing the RoleProvider to not resolve role names...

I had the role provider set applicationName="" in the FBA Utility. I believe this sets the application name to "/Fba Utility site" as default. In sharepoint I had it set to applicationName="/" that has a different applicationid which is used for finding the role.

Once I changed the applicationId for the role - it worked. I set the applicationName="/" in the "FBA Utility Site" and future roles created all resolved.

Thanks again!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/8/2007 4:22 AM yehxin

regarding the mysite issue they mention aboved.. I too met the same problem. The link is hidden because the form authenticated users do not have access right to mysite function. you can try clicking on the create my own site in the front page of collaboration template... still finding solution on it... anybody have the same prob?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/8/2007 8:11 AM AC [MVP MOSS]

yehxin - The problem is that you haven't created a provider to import/create a profile for your user, which is required for a MySite. When you are using Windows authentication, SharePoint automatically creates a profile for the user when (1) they are imported in to the profile store or (2) the first time they hit the site. You'll have to implement this with your FBA solution in order to get MySites working under FBA.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/8/2007 12:27 PM yehxin

hi AC, Thanks for fast response..actually i also juz notice about this issue a while ago... i am wondering since the FBA is juz working as a membershipprovider...so should I make synchronization between the DB and user profile. I once think that use the BDC to make a import connection for the user profile and DB. anyway there's no complete documentation on MSDN yet.I also facing prob when trying using my BDC bcos some exception thrown by the importer during BDC import. Or do u have a better solution for that instead of using BDC way?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/8/2007 2:49 PM AC [MVP MOSS]

yehxin - I haven't done much work with creating a profile import routine or using the BDC so I really can't speak intelligently on either concept. I do think using the BDC is the way to go though.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/9/2007 6:05 PM geneb

AC: your description is exactly what we are trying to implement. I followed the procedure and it works great. Now i'm pulling my hair out because when i go into CentralAdmin/Operations/GlobalConfig/AlternateAccessMappings/EditPublicURLs/Internet and point my newly configured internet site to our internet domain name, the user gets prompted for a username (which does NOT happen if i do the http://internet on same box). The prompt is not the form used with forms auth - it is the one used with ActiveDir. Can you point me in a direction on how to get past this? Any help appreciated.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/11/2007 9:45 PM AC [MVP MOSS]

geneb - I suggest you walk through the steps in this article... many people have had no problem getting it to work for them, so I suspect you may have overlooked something.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/12/2007 4:08 AM LaurentB

Andrew,
Thanks very much for this fantastic article.

I would like to have only one internet site, allowing both AD users and external users (stored in SQL) to login. As you mentionned it requires mixed auth providers.

Does anyone have a starting point to implement this. I haven't found anything great so far and I don't know what to do... help !

Thanks.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/13/2007 11:06 AM oozydigg

This article was great. Everything worked perfectly. Thanks a lot!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/13/2007 9:16 PM Sash

Excellent post and takes one through every minute details. Adding a note for novice w/o DNS entries to use host entries might help.

I am trying to build a site where I want the documents and other postings to go through an approval process internally on an intranet site and then manually trigger some kind of workflow to get get all approved content/docs to post on the external internet site. (both the sites might be on different servers) I am hoping this article might help but not sure how! :| Can you please give your insights on how I can accomplish this?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/13/2007 9:25 PM AC [MVP MOSS]

Sash -
This article doesn't address what you're looking for. Take a look at the info surrounding content deployment in MOSS 2007 for what you're looking for.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/15/2007 10:26 PM John

I run a WSS 3.0 site and we have a number of users that authenticate through AD and are in the process of allowing anonymous access to select users to specific areas of the site.

Your article is very informative and exactly what I am looking for to help me implement this. I was wondering if you knew what licensing issues there are involved with allowing anonymous access to a WSS site. We obviously have licenses for all our AD users but what would we need in order to allow anonymous access to the site?

Thanks for the great article.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/15/2007 11:05 PM AC [MVP MOSS]

John-
Short answer: go find your nearest MSFT rep.Long answer: opening SharePoint to non-CAL holders requires the purchase of a "MOSS 2007 Internet license" or something like that... and it's not cheap. Make sure you are aware of this before you move forward with your plan, because it's pricy.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/19/2007 2:34 PM Victor De Cerqueira

Andrew,

This is indeed an excellent article and addressed pretty much every single question I had about setting up a CMS with both public and private facing sites. Thanks so much!

I do agree that a couple of sentences about relating the extranet/intranet sites to localhost would be in order so that folks following your article don't get surprised by an "unable to load page"-like message when they try to access http://extranet or http://intranet.

One issue I ran into when setting up this site (and I imagine a lot of people might run into it during the initial setup of a MOSS 07 CMS) is that of moving around content types. For instance, I had created a few custom content types and a few lists based on those. I would like to be able to transfer my these custom content types (or possibly the content type group containing them) from my old web application to the new one I created from your article. I don't see an easy way of doing this other than hacking the Content Database, which can be dangerous.

Do you have any ideas on that?

Thanks again for an outstanding article!
Victor

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/19/2007 3:45 PM AC [MVP MOSS]

Victor-
There is no way OOTB to move content types form one site to another. The only way you can do this is if you either write custom code to do so as content types are exposed in the API or create you content types via XML using features which will let you activate them on a site collection or individual web. This is the motivation behind my custom commands project: http://andrewconnell.com/blog/articles/MossStsadmWcmCommands.aspx

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/21/2007 4:21 PM Mike Stevens

Andrew,

Thanks for the detailed article! I am trying out .NET forms authentication, but am stumped at the moment...is client integration (particularly Office) possible using this authentication provider? I can log into my site correctly, but when I try to "Edit" a file in a document library, the option is not there (?) I also cannot save renamed versions of the files directly from the client application (I can only upload directly on the SP site).

Any ideas, pointers, or references on this subject?

Mike Stevens

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/22/2007 8:00 AM AC [MVP MOSS]

Mike-
The Office clients don't understand Forms Auth, only Integrated Auth. I've read where if you browse to a site that leverages FBA, login (which sets a cookie), then try the Office client, it will work.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/23/2007 2:36 PM KJM

Andrew, this is a great article. However, I am stuck on the part where you add your newly created user on the Add Users page. My user will not resolve. I quadruple checked the web.configs and the Site Admin auth. providers. Both of my connections test out ok in the VS 2005 tool. Not sure what to do next.

Btw, I tried using FormsAuthMembershipProvider as a name and I did not get the test link. I was forced to use FormsAuthSqlMembershipProvider as the name to get the test link. I guess it looks for "sql" in the name???

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/26/2007 3:28 PM SShah

Great Article!!!
I tried to implement this. but only question i had is -
I don't want form authentication . only windows authentication but i want 2 web application one is anonymous while another one is secure and can be opened once you clickon Sign on anonymous one.
So i tried ti implement above aritcel but excluded the datastore creation as i am using Active directory and even excluded the steps for editing the web.config. Is this the rite way to implement as i am not getting it to work. Or creating form authentication is mandatory?

Thanks

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/26/2007 11:53 PM AC [MVP MCMS]

SShah-
There's nothing special about FBA... that's the beauty of pluggable auth. My guess is you either didn't setup anonymous access on the web app in IIS, or in the zone.

# How to cofigure .aspx page so that when render it is display according to user role in sharepoint 2007 2/27/2007 12:12 PM Alok Kr. Suman

How to cofigure .aspx page so that when render it is display according to user role in sharepoint 2007

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/27/2007 12:28 PM AC [MVP MCMS]

Alok-
Sorry, I don't understand your question, you'll need to provide more info.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/27/2007 10:04 PM Tim Long

This is a great article and has actually helped me solve an unrelated problem I was having.

I decided to try following through your step-by-step guide. Great idea about using Visual Studio to create the web.config!

I came unstuck at the point where I needed to add users. This is because my SQL server is on a different machine to the SharePoint server - so running the aspnet_regsql script creates the database but it doesn't assign all the correct permissions for the SharePoint service accounts. This is apparent from looking in the SQL logs. It would be a great addition to this article if you details exactly what database permissions are needed and how to add them.

In my installation, I needed to add my WSSDataAccess account and my MACHINE$ account to the database permissions.

Many thanks for the article.
--Tim Long
--TiGra Networks

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/27/2007 10:14 PM GregP

This makes a lot of sense, but I am still having (what would seem) an easy issue to resolve, but is causing me great pain.

I have just one site set up that is going to be used predominantly as an internet, but have a component for users to login as an extranet. I have gone thru everythign and still I am having a significant issue. Anything that is a list or library is not visible when logging and requires a password if I enter the URL directly.

Background:
* SharePoint 2007 installed and all components of the website appear to work correctly when anonymous access is not enabled and I login.
* "Anonymous Access" setup on IIS. (done)
* Central Admin -> Application Management -> Authentication Providers -> "Enable anonymous access" is checked (done)
***** Set up to use Windows Authentication
* Main Site -> Site Actions -> Site Settings -> Modify All Site Settings -> Advanced Permissions -> Settings -> Anonymous Access -> "Entire Web Site" (done)

- If I only do "List and Libraries" it will automatically prompt me to login as expected.
- I have tried specifically enabling anonymous access on every list and library; with no luck.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 2/27/2007 11:43 PM AC [MVP MCMS]

GregP
Sorry, but all I can say is doublecheck your configuration and verify all steps outlined in the article. Many have been able to do the same thing and had no problems getting it to work. I know, not the answer you want, but I'm not sure how I can help here... :(

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/2/2007 1:01 PM SShah

Thanks AC for your response. but i have tried all the steps and even double checked that anonymous is enabled in Moss as well as in IIS and still it prompts me for credentials.
I have even added that user to the policy under application management and given full control.
I have followed all the steps from this article thoroughly except for integration with SQL datastore.

Please advice

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/3/2007 2:36 PM Samba

Hi AC,
I thank you for your article. I 'd like to configure my MOSS with a form authentication by Active Directory.
When I sign-in, the login page display the user account and Ia message "Error acces". The user exists on Active Directory and he has rigths to navigate on the moss site.

Thank you for your help. I'm desabused after many tests.

best regards

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/3/2007 7:10 PM Sukhi

Dear Andrew
I know some people mentioned about entry in DNS or HOSTS file above.

I cant get http://extranet or http://internet working, so I am stuck at near the beginning.

Is it to do with entry in DNS, if it is, how to create one.

Thanks in advance.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/3/2007 10:40 PM Sukhi

Hello again
I dont seem to be able to open http://internet site. I get 'Internet Explorer cannot display the webpage'....

I have feeling I might not have changed the correct web.config for the central administration.

I could easily find extranet80 and internet80 directories under 'C:\Inetpub\wwwroot\wss\VirtualDirectories' but dont seem to find central admin directory.

Could you please advise.

Kind Regards
Sukhi

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/4/2007 9:48 AM AC [MVP MOSS]

Samba-
Sorry.. not sure what you're asking (form auth by AD?).

Sukhi-
The HOSTS file is on every Windows PC... it is checked before requesting a name resolution from DNS, so you can think of it as your local DNS. You'll find your HOST file here: c:\windows\system32\drivers\etc\hosts. Add a new entry for "internet" and "extranet" just after the "localhost" entry. Then you don't have to worry about DNS. However, this isn't the way you want to do it in a production environment... you'd want to use DNS.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/4/2007 12:07 PM Samba

Hi AC,
I have a site with anonymous acces and a extranet extende on the site anonymous. The extranet should be access with a forms based on Active directory and not windows prompt.
Have you a way for me.

sorry AC, my english is not well

best reagrds

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/4/2007 1:19 PM AC [MVP MOSS]

Samba-
What you describe is definately do-able. You are simply creatng your own provider. Just follow the directions in this post and instead of using the ASP.NET FBA provider, use your custom provider which knows to validate against AD.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/7/2007 10:35 AM Peps

Andrew,

Sorry but I have a dumb question. We are trying to create a new Publishing site but the Publishing Template tab is not available to us, all we have are Collaboration, Meetings, Enterprise and Custom sites.

We have searched high and low but cannot find a way to make the Publishing tab available.

Can you help us here?

Thanks,
Peps

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/7/2007 11:08 AM AC [MVP MOSS]

Peps-
Sounds like you aren't running MOSS 2007 RTM. I think "Enterprise" was a Beta tab... you probably see the beta equivalent of "Publishing Portal" which is "Internet Presence Site"

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/12/2007 7:38 AM Minen Mehta

Andrew,

Thanks for a great article. Have been absolutely successful in configuring the stuff described in this article. However I have a couple of queries...

1) How would the audience piece work with Forms Auth? I mean do I need to expose my user profile data store using BDC n use it then? If yes, do u see any problems in using this in the long run, limitations if any...?

2) "Edit in Microsoft Word" option is not visible in document library word documents.. Does this mean that there can only be uploads of documents...Edits to an existing document is not possible....Is there any tweak or an alternate option to get this working?

Thanx in advance

Minen.

# Deploying to two different servers in the farm? 3/13/2007 11:28 AM Thomas

This is a GREAT article! Thanks! My question is...is there anyway to have the extension (the public site) deployed to n servers in the farm and have the admin site deployed to, for example, a different server in the farm (that might require a VPN to access)? That way there will be NO access to the content admin from the internet zone.

Thanks!

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/13/2007 12:32 PM Craig

Aww, I thought the point was that MOSS would support forms auth against AD out of the box. So I have to roll my own providers still? Oh well, that's that budget blown.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/13/2007 8:06 PM AC [MVP MOSS]

Minen-
Audiences are based off profiles, so you'd have to implement a profile provider to build them. The authentication mech used makes no difference (Windows/FBA)... you just need to get the profiles into MOSS.

Thomas-
Not sure, but I'd think so. I'd post this to the SharePoint setup & admin newsgroup.

Craig-
MOSS does support any auth provider out of the box... but you have to tell it which one to use. FBA simple reqires a datastore for the users, so you have to create it. That's absolutely nothing to do with SharePoint... it's provider specific.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/20/2007 12:45 PM Olivier Balmer

HI

Thanks for this documentation . It 's really fine and very simple.

I have a question. How it is possible to create the username and password without using Visual Studio ( like the first login you create in your documentatation ) .

It is possible to have a webpart to create username/password that store into the database ???

Thanks for your reply .

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/20/2007 7:27 PM AC [MVP MOSS]

Olivier-
Sure... its definately possible. Look at the System.Web.Security.Membership.CreateUser() method.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/21/2007 5:26 PM Máximo Mártínez

How can I get Sharepoit to *NOT* show the sign in when accesing it from the Internet? I want my internal users to edit but my external users to read and nothing else...

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/22/2007 12:04 AM Max Obrien

AC- I've followed all of your instructions and you've put together a great how-to. Thanks alot.
I am getting one problem that I can't figure out. I created the http://extranet site but my drop-down buttons don't work. I can't click my "Site Settings" button or any other of the navigation buttons.
I did create a teamsite and a My Site before I went through this excersize and both those sites navigation works perfectly. Any ideas what I could have done?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/22/2007 8:37 AM AC [MVP MOSS]

Maximo-
Doesn't sound like the site collection is setup for anonymous access, the zone isn't setup for anonymous access, and/or the IIS site is allowing it either. Note the security prompt is coming from IIS, not SharePoint.

Max-
That's really odd... sounds like the JavaScript isn't working in that zone. Any chance your IE settings are blocking it? Tried it in FireFox yet?

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/22/2007 12:08 PM Máximo Martínez

Andrew:

It is set up for anonymous access and the auth does not come from IIS. When you set it up for Anonymous access Sharepoint places a link in the top right corner that says "Sign In", after you click this it gives you a form or prompts for credentials. What I want to be able to do is remove that option so I can there is no way to access the administrative side of sharepoint from the outside.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/22/2007 2:29 PM AC [MVP MOSS]

Maximo-
Look in the source of the master page... there's a control that is creating the sign-in link. You can easily remove it by editing the master page for the site.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/22/2007 6:57 PM Olivier bAlmer

One important question we have gotten on multiple authentication providers is, how can I send a link to a site to someone who accesses it through a different URL? Will they be prompted to switch URLs, or will they get login error, or will it automatically direct them to the correct URL? This is very important, as the requirement to use different URLs for different providers will otherwise be a showstopper for a lot of organizations.

I have follow your instruction all is working fine. But link is not correct.

Thanks for your help .

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/22/2007 9:10 PM Max Obrien

AC- The JavaScript problem is the issue. I tried it on Firefox and it works. Thanks,

Max

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/26/2007 12:42 AM Ivan

Hi there,

Got a curly one here: I have an Instance of MOSS in a DMZ with an AD (Forest A) also in that DMZ this Forest has a one way trust into the corporate intranet to the forest on the inside.

I have an extended Application (Windows Port 80 and Forms port 90) and in Windows Authentication users from both domains can log in well and roles are also recognised.

It seems that I cannot get any user or role information from (Forest A) to be authenticated by the forms instance. My Role and user detaisl in Web.confs is pointing to the DMZ AD. I thought that the trust would allow this to work?

Any help would be greatly appreciated.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/26/2007 4:14 PM AC [MVP MOSS]

Ivan-
Multiple forests? Hmm... not sure... I'd post this one to the setup & admin or development SharePoint newsgroups.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 3/26/2007 5:46 PM Ivan

Hi there!

Thank you I have taken your advice and postsed it there.

I guess however if these 2 dmaons in forest, perhaps all would work...

I'll try that in dev.

Ivan

# Anon Access not working 4/3/2007 12:08 PM ChrisN

AC,

we configured WSS exactly according to your Article:
Everything's working fine except for the anonymous access to the "http:/internet" site. The default login page is displayed.
Anon access is configured in IIS-Admin and in the Anonymous Access Section of http://internet under FbaAdministrator Login. Where else do we have to take a look at? Any ideas?

Thnx,
Chris

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 4/3/2007 12:13 PM AC [MVP MOSS]

ChrisN-
Please recheck the steps outlined in the article. The steps here document the entire process how to set it up.

# Users Adding to http://extranet not working 4/6/2007 6:44 AM Jawahar

First of all, let me thank for such a wonderful informative blog on Sharepoint.

When i tried to add the database user to the http://extranet site , its throwing error "no exact match was found".
Then i checked, whether the administrator account is available as a site collection administrator and yes it is there.

The database is also having the adminstrator in it as a security user.
Still i could nt able to add the database user in the extranet site.

Since i got into this problem, my development is really delaying much.

Any help will be appreciated.
Thanks in advance.

# re: HOWTO: Configuring a Office SharePoint Server 2007 Publishing Site with Dual Authentication Providers and Anonymous Access 4/7/2007 2:34 PM AC [MVP MOSS]

Jawahar-
You want to make sure the Application Pool identity has rights to the database... it has nothing to do with the site owner/administrator.

Comments have been closed on this topic.

This work is licensed under a Creative Commons License
Site design by Heather Solomon.