/
Access SharePoint using Basic Authentication and SSL (via Alternative Access URL) with SP 2013 (v 1.9)

Access SharePoint using Basic Authentication and SSL (via Alternative Access URL) with SP 2013 (v 1.9)

Nov 24, 2016

This page is part of the installation guide for the Confluence SharePoint Connector. It tells you how to configure access to SharePoint using basic authentication and SSL via an alternative access URL in SharePoint. These instructions apply to the connector for SharePoint 2013.

On this page:

Overview

In this configuration, client browsers authenticate against SharePoint using Integrated Windows Authentication (NTLM or Kerberos). Confluence however, authenticates against SharePoint on a separate port that is configured to use basic authentication over Secure Sockets Layer (SSL). This is accomplished using SharePoint's capability to extend a site collection over multiple web applications. Using alternative access mappings in SharePoint, all hyperlinks in the SharePoint content direct users back to the primary SharePoint site.

This configuration method offers a greater level of security than the method that  accesses SharePoint using Integrated Windows Authentication (NTLM Only). The configuration procedure is, however, more complex. You should review the security measures of your internal network before deciding which method is most appropriate for your environment.

Use this Configuration when...

  • Confluence is not running on a Windows server.

  • Your corporate security policy prohibits the use of NTLM(v1) authentication, which is necessary for the NTLM configuration.

  • Your SharePoint site(s) is/are not configured to use Secure HTTP (HTTPS) and you are concerned about the possibility of packet sniffing or eavesdropping.

If you have not already seen our guide to planning your environment, you can refer to it for information that will help you select the best configuration for your environment.

Caveats

Server Certificate

Enabling SSL requires the installation of a certificate on the SharePoint server. Depending on the way in which you source the certificate, this could involve either an additional financial cost or a number of additional configuration steps.

Installation Instructions

Configuring SharePoint

Use IE7+ when Configuring SharePoint

We recommend that you use Internet Explorer 7 or later to perform the configuration steps described on this page. You may experience unusual behavior if you use FireFox or other browsers on some SharePoint administrative pages.

Configure all SharePoint Top-Level Sites used by Confluence

You will need to perform these configuration steps for each SharePoint top-level site that is exposed to Confluence.

Step 1: Extend the SharePoint Site to Another IIS Web Site

  1. Log in to SharePoint Central Administration and select the 'Application Management' portal.

  2. In the 'Web Applications' section, select 'Manage web applications'.

  3. Select the required SharePoint site and click 'Extend'.
    Screenshot: Selecting 'Extend' for a SharePoint site

  4. The 'Extend Web Application to Another IIS Web Site' screen appears. Select 'Create a new IIS web site'

  5. Fill out the details of the new site:

    • Add a meaningful name that describes the purpose of the site.

    • Ensure that the IIS web site is assigned a unique port that is not currently in use on your SharePoint server.

    • Ensure that 'Allow Anonymous' is set to 'No'.

    • Ensure that 'Use Secure Sockets Layer (SSL)' is set to 'Yes'.

    • Make a note of the 'Zone' that is set for the 'Load Balanced URL'. You will need to know this zone in step 2 below.

  6. Click 'OK'.

Screenshot: Extending the SharePoint site to another IIS web site



Step 2: Configure the IIS Authentication Providers

  1. Go back to SharePoint's 'Manage web applications' section.

  2. Select the required SharePoint site and click 'Authentication Providers'.
    Screenshot: Selecting 'Authentication Providers' for a SharePoint site



  3. The 'Authentication Providers' screen appears. Click the name of the Zone (such as, 'Intranet' or 'Internet') that you used to extend the SharePoint site in step 1 above.

  4. The 'Edit Authentication' screen appears. Ensure that 'Integrated Windows authentication' is not selected and 'Basic authentication (password is sent in clear text)' is selected.

  5. Click 'Save'.

SSL will secure the password information

Because this endpoint will be using Secure Sockets Layer (SSL), the password will not be sent in clear text even though basic authentication is used.

Screenshot: Editing the IIS authentication settings

Step 3: Configure the Alternate Access Mappings

In this step you will remove the default public URL that SharePoint created during the previous step and replace it with an internal URL mapping.

  1. Go back to SharePoint Central Administration and select the 'System Settings' portal.

  2. In the 'Farm Management' section, select '*Configure alternate access mappings'.

  3. Click the link on the 'Internal URL' that represents the newly-created IIS web site defined in step 1 above.
    Screenshot: Finding the newly-created alternate access mapping to delete

  4. Click the 'Delete' link to remove this mapping.
    Screenshot: Deleting the alternate access mapping

  5. Click 'Add Internal URLs'.

  6. Select the 'Alternate Access Mapping Collection' that represents the root SharePoint site that you are extending.

  7. Set the 'URL protocol, host and port' to the URL that directs to the newly-created IIS web site defined in step 1 above.

  8. Click 'Save'.

    Screenshot: Adding the alternate access mapping

Step 4: Import the SSL Certificate into IIS