Authentication in WSS is not really different than with any other ASP.Net web application. You can use both forms and windows authentication and that is it. There are some considerations however to keep in mind when choosing a form of authentication. While a web browser has no problem at all to show you a login form, other applications such as Microsoft Office Word 2007, Microsoft Office Excel 2007 and Microsoft Office Access 2007 cannot work with forms authentication. Considering that a very large part of the files you collaborate on are Microsoft Office Suite files it would be a very bad choice to use forms authentication for your intranet zone. For an internet zone however forms authentication could be the perfect choice. Although your internet clients will miss the client integration with their Microsoft Office files, you do not have to maintain their accounts in the Active Directory on your windows domain. With forms authentication you can still download the files, update them using your program of choice and upload the files accordingly. You should use Windows Authentication internally and Forms Authentication externally. Authorization Use if you can. And that advice basically applies to everything Microsoft. Use roles in Microsoft Windows authorization, Microsoft SQL Server authorization and WSS authorization whenever you can. There are situations where you cannot use roles. In a timesheet list you might want everybody in the department” role to have read rights “HR and just one person, the owner of the timesheets in that list folder, to have contributor rights. One of the great pitfalls you can step into with authorization is to get to granular with it. Although WSS gives you the option to set authorization up to the list item level you do not have a centralized administration of user rights. Things can get very complicated by the time you reach the 10,000 users and 5000 sites with 1000 lists containing 100,000 list items. Stick to roles whenever you can and do not go any more granular than folder level authorization. Storage Sites and Site Collections Figure
Authentication in WSS is not really different than with any other ASP.Net web application. You can use both forms and windows authentication and that is it. There are some considerations however to keep in mind when choosing a form of authentication. While a web browser has no problem at all to show you a login form, other applications such as Microsoft Office Word 2007, Microsoft Office Excel 2007 and Microsoft Office Access 2007 cannot work with forms authentication. Considering that a very large part of the files you collaborate on are Microsoft Office Suite files it would be a very bad choice to use forms authentication for your intranet zone. For an internet zone however forms authentication could be the perfect choice. Although your internet clients will miss the client integration with their Microsoft Office files, you do not have to maintain their accounts in the Active Directory on your windows domain. With forms authentication you can still download the files, update them using your program of choice and upload the files accordingly. You should use Windows Authentication internally and Forms Authentication externally. Authorization Use if you can. And that advice basically applies to everything Microsoft. Use roles in Microsoft Windows authorization, Microsoft SQL Server authorization and WSS authorization whenever you can. There are situations where you cannot use roles. In a timesheet list you might want everybody in the “HR department” role to have read rights and just one person, the owner of the timesheets in that list folder, to have contributor rights. One of the great pitfalls you can step into with authorization is to get to granular with it. Although WSS gives you the option to set authorization up to the list item level you do not have a centralized administration of user rights. Things can get very complicated by the time you reach the 10,000 users and 5000 sites with 1000 lists containing 100,000 list items. Stick to roles whenever you can and do not go any more granular than folder level authorization. Storage Sites and Site Collections Figure
BizTalk%20Server%202009%20and%20SharePoint%202007%20Integration%20-%20Best%20Practices%20-%20Technical%20White%20Paper.docx