Several new capabilities are introduced
in SharePoint 2013, and the following sections cover those most
pertinent to the administrator. As you plan to upgrade to SharePoint
2013 from SharePoint 2010, you should be planning your strategy to
migrate classic-mode websites to claims-mode websites. The user
authentication infrastructure is now more efficient and effective, as
login tokens are now cached using the Distributed Cache Service.
SharePoint 2013 can share resources and information more securely with
other applications using the server-to-server authentication process.
OAuth, which is new to SharePoint 2013, is used to provide access to
resources.
Migrating from Classic to SharePoint 2013 Claims
This is a very important topic for
SharePoint administrators, as Windows claims authentication is the new
default user authentication mechanism for SharePoint 2013 when you
create a new SharePoint 2013 web application. SharePoint 2013 will
continue to support classic-mode authentication, but the capability to
create a classic-mode SharePoint web application is no longer available
using the web browser. You can still create a classic-mode web
application using PowerShell, but claims authentication is recommended
and it is required to support all SharePoint 2013 functionality.
SharePoint 2013 supports three different types of
claims authentication: Windows-based claims, Security Assertion Markup
Language–based (SAML) claims, and forms-based authentication (FBA)
claims. Organizations that used classic-mode authentication in
SharePoint 2010 have the following supported options for migrating to
claims-based authentication:
- Migrate from classic authentication to claims authentication in
SharePoint 2010. SharePoint 2010 content can then be migrated to
SharePoint 2013 via normal methods (database attach, etc.).
- Migrate the SharePoint 2010 content to SharePoint 2013 via the
database attach method. Convert the classic-mode web application to use
claims via PowerShell.
SharePoint 2013 introduces new PowerShell cmdlets
to accomplish this migration.
NOTE At
the time of this writing, Microsoft is publicly stating that
classic-mode authentication is being deprecated, and therefore is
encouraging all organizations to migrate to claims in SharePoint 2010
if possible before upgrading to SharePoint 2013.
Authentication Infrastructure
SharePoint 2013 introduces the new
Distributed Cache Service (DCS), which is used to cache login tokens
(also known as FedAuth cookies). This is a big improvement over
SharePoint 2010, which stored the login token on each web front-end
(WFE) server in the farm. In SharePoint 2010, users who are redirected
to a different load-balanced WFE often need to re-authenticate when
using SAML or FBA authentication if load balancer affinity, also called
sticky sessions, is not enabled. Therefore, sticky sessions are no
longer required with SharePoint 2013. In addition to the use of the
DCS, SharePoint 2013 has much more verbose logging of the claims
authentication process. The ULS logs contain much more information
about user authentication, such as user redirection, token addition and
removal from the cache, and so on, which helps to manage and
troubleshoot claims.
OAuth
SharePoint 2013 supports and extends
the OAuth 2.0 standard. As mentioned earlier, OAuth is an industry
standard protocol that enables users to authorize an application to act
on their behalf without sharing their username and password. This is
accomplished by establishing a trust relationship between the
applications, which means you don’t have to assign a Windows login
credential to an application. This enables users to, for example, share
their resources or data (SharePoint lists, documents, photos, and
videos) stored on one website with another website, or use this
information as input for a custom application. OAuth is used only for
resource access, not for user authentication. As you might guess, the
new SharePoint 2013 Cloud App Model (also referred to as just the App
Model) uses OAuth extensively to authorize apps to access resources on
behalf of users.
SharePoint 2013 uses OAuth to allow applications to access SharePoint resources in one of three ways:
- With the combined permissions of the application and the user
- With only the permissions of the application
- With only the permissions of the user
The app is given access to these resources by
defining a trust relationship between the application and SharePoint
2013. Depending on the architecture of the application, a trust
relationship between SharePoint 2013 and a cloud provider such as
Windows Azure Access Control Service (ACS) can also be established.
These trust relationships are very similar to the trust relationships
used for authenticating SharePoint users with claims authentication. We
provide a more detailed discussion of the claims authentication process
in the User Authentication section.
Server-to-Server Authentication
Server-to-Server (S2S) authentication, which is used to create SharePoint high-trust apps,
is a scenario for application-to-application authentication, and OAuth
provides the basis for this capability. S2S uses a Microsoft extension
of the OAuth protocol to enable services or servers to share resources
on behalf of a user, and this user does not have to be authenticated.
S2S requires user profiles, so user profile mapping and profile imports
must be configured. For all those interested in using SharePoint
Foundation 2013, high-trust apps are not possible because user profiles
are required and not available in Foundation. S2S allows SharePoint to
share information across SharePoint 2013 farms, and with other
S2S-compliant applications. For example, the following SharePoint 2013
capabilities utilize S2S:
- eDiscovery — The Electronic
Discovery capability enables SharePoint 2013 to index mailbox content
in Exchange Server 2013 and conversation content in Lync Server 2013 to
include that information as part of a legal hold.
- Task management — Tasks created in Outlook 2013 or in SharePoint 2013 are synchronized and viewable from a user’s personal site.
- Site mailboxes — These are Exchange 2013 mailboxes that are rendered and viewable from SharePoint 2013 websites.
