A lot of companies using SharePoint use Forms Based Authentication (FBA) as a way to extend a site for non-Active Directory (AD) users. I will not discuss the steps required to enable or extend a site. This has been discussed in numerous posts on other blogs. I would recommend doing a Google or Live search if you need that information. What I am going to discuss are issues to consider when extending a site through FBA.
Okay what is FBA in relation to SharePoint? FBA is an alternate authentication method to access SharePoint sites. The standard SharePoint installation uses AD to query a Domain Controller to check a users credentials this is Windows Authentication. FBA uses a database that is created separate of AD to store the user credentials. Authentication in FBA is performed by executing a SQL query on the database to check a users credentials. When you extended SharePoint through FBA you are setting up a way for external users (users not in your AD) to access SharePoint.
Why extend a site? A good reason for extending a site through FBA is client access. For example - you are using a site to track a project. You do not necessarily want to add a client to your AD. Instead if you extend the site and enable FBA the client can access your site and not become part of your AD.
When a site is extended through FBA here are a few of the issues that need to be considered:
- Alternate Access Mapping
- Client Integration
- Permissions
- Audience Targeting
Alternate Access Mapping -
A site will need to have an alternate way to access it besides the URL setup for AD access. This means that an alternate address will need to be associated with the FBA extended site.
Client Integration -
Since FBA is not the default form of authentication in SharePoint some client features a user can perform on a site are limited. There are workarounds for some of these issues. But it is important to realize that FBA is not natively supported by client integration.
Permissions-
If you are running an extended site with FBA you will need to plan a good strategy for what external users (non-AD) can access. This is no different than normal security considerations for groups and users in windows authentication. Keep your FBA users in specific SharePoint Groups separate of your AD users.
Audience Targeting -
This almost goes hand in hand with permissions. Do not forget that you can target things like web parts to be available to SharePoint Groups. This becomes valuable if you have kept your FBA users in separate groups from your AD users.
Being aware of these issues helps in the planning and deployment of SharePoint with FBA access. The last thing to remember and consider is documentation. If time is being taken to plan for FBA make sure to document the procedures that are developed to answer these issues.