Kerberos、NTLM、表单、基于声明、活动目录的使用？
在经历了分析用于 Sharepoint 构建的身份验证方法的困难过程后，我必须诚实地说，我对最佳用例是什么感到困惑。它将用作内部网和外部网，我想知道其他人正在使用什么身份验证方法以及他们为什么选择他们所做的身份验证方法。
非常感谢！
Kerberos, NTLM, forms, claims based, use of active directory?
Going through the difficult process of analyzing which authentication method to use for a Sharepoint build-out, and I must be honest in saying that I'm confused as to which the best use-case would be. It's going to be used as an intranet and extranet, and am wondering what authentication methods other people are using and why they chose the authentication method they did.
Many thanks!
发布评论
评论（2）
我们使用基于声明的 kerberos。
基于声明是因为我们从 Windows 身份验证开始，但希望保留启用基于表单的身份验证的选项。 （基于表单的身份验证在经典模式下不可用）
Kerberos，因为它允许我们克服双跳问题。
设置 Kerberos 会带来一些额外的配置要求。虽然乍一看似乎很吓人，但它有详细记录： http://www.microsoft.com/downloads/en/details.aspx?FamilyID=1a794fb5-77d0-475c-8738-ea04d3de1147&displaylang=en
基于声明的身份验证也存在问题/限制，但直到现在我还没有遇到让我改变主意的事情。
就您的情况而言，如果您希望将 SharePoint 作为 Extranet 环境使用，您可能需要进行基于声明的身份验证。这样，您就可以对内部人员使用 Windows 身份验证，对外部人员（客户/供应商/...）使用表单身份验证。
We use claims based kerberos.
Claims based because we started with Windows authentication, but want to leave the option for enabling forms based authentication open. (Forms based authentication is not available in classic mode)
Kerberos because it allows us to overcome the double-hop problem.
Setting up Kerberos brings some additional configuration requirements. Although it may seem intimidating at first, it is well documented: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=1a794fb5-77d0-475c-8738-ea04d3de1147&displaylang=en
Also claims based authentication has it's problems/limitations, but until now I didn't encounter something that made me change my mind about it.
In your case, if you want to make your SharePoint available as an extranet environment, you may want to go for claims based authentication. That way you can use Windows authentication for internal people and forms authentication for external people (customers/suppliers/...).
在进行集成时，NTLM 是首选，Kerberos 很好（而且更安全），但如果 AD 出现故障，您的内联网和外联网将无法访问。
因此，如果您偏执，请选择 Kerberos；如果您想要高可用性和足够好的安全性，请使用 NTLM。
When making integrations NTLM is the preferred one, Kerberos is nice (and safer) but if the AD goes down your intranets and extranets wont be accessible.
So, Kerberos if you are paranoid, NTLM if you want high availability and good enough security.