Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 15: Configuring Windows SharePoint Services 377
■ Integrated Windows authentication. Integrated Windows authentication
(also known as Windows NT Challenge Response) encrypts user names and
passwords in a multiple-transaction interaction between client and server, thus
making this method more secure than Basic authentication. Disadvantages are
that this method cannot be performed through a proxy server firewall, and
some Web browsers (most notably, Netscape Navigator) do not support it. You
can, however, enable both this method and Basic authentication at the same
time, and most Web browsers will select the most secure option. (For example,
if both Basic and Integrated Windows authentication are enabled, Microsoft
Internet Explorer will try Integrated Windows authentication first.)
■ Certificates authentication. Certificates authentication provides communications
privacy, authentication, and message integrity for a TCP/IP connection.
By using the SSL protocol, clients and servers can communicate in a way that
prevents eavesdropping, tampering, or message forgery. With Windows Share-
Point Services, SSL helps secure authoring across firewalls and allows more
secure remote administration of Windows SharePoint Services. You can also
specify that SSL be used when opening any website based on Windows Share-
Point Services.
You can change authentication methods for virtual servers hosting websites
based on Windows SharePoint Services, and you can change the authentication
method used for the SharePoint Central Administration site. You can also enable
Secure Sockets Layer (SSL) security in IIS to help protect your sites or the administration
port for your server.
Caution It should be strongly noted that enabling SSL after establishing the
Windows SharePoint Services site is very difficult. The reason is that Windows
SharePoint Services in some cases uses the https:// protocol behind
the scenes when interfacing with the database. This then makes changing
the URL after the fact a difficult task.
Changing Authentication Methods
Each virtual server can use a different authentication method in Internet Information
Services (IIS). You can even enable multiple authentication methods if you are using
the same website content in more than one environment. For example, if you have a
website that is primarily for internal use within your organization, you would most
likely choose Integrated Windows authentication. (It should be noted here that Internet
Explorer must be your organization’s standard browser.) If, however, your use of
the site changes and you must allow your organization’s members to access the site
externally through a firewall, you might also want to enable Basic authentication.