Tag Archives: Authentication

zones in sharepoint

Posted on by
Reply

default zone in SharePoint

Zones are different logical paths expressed as URLs that allow access to the same web application. The default zones in sharepoint is 5. A web application can support up to five Default Zones. The available zone names are Default, Extranet, Intranet, Internet, and Custom. 

default-zone-1236x552

default-zone-1206x341

One particular zone name can be used per web application. Zones using the same name across different web applications typically are available for the same user pool to control access for that group. For instance, your internal employees can use the Intranet zone to access all of the SharePoint sites configured to use that zone, giving that group the same sort of access to all relevant web applications. Each zone is expressed as a separate website in IIS. Zones isolate users based on authentication type, network zone, and policy. All zones have own Port number and Protocol http/https. Different authentication methods can be applied to login different zones like Forms authentication in Intranet and default Windows authentication. we can configure Blob and Distributed cache differently for different zones. When planning for zone deployment, particular attention must be paid to the Default zone, since access to this zone may be gained by anyone who is able to use a link to this zone, such as a URL sent via an automated administrative email. The Default one or any zone used for an outward-facing site must possess a high level of security.

Access Requests Explained for SharePoint 2013 – With a Script to Assign Default Groups

Posted on by
Reply

One of the features of SharePoint that has been around is the ability for users that need access to a site, and are denied access, through the “Request Access” process.

To enable or review these settings,

  • go to “Settings” > “Site Settings” > “User and Permissions” and click “Access Request Settings”. In the “Access Request Settings” dialog box, select the check box next to “Allow access requests” then provide an email address of the individual you’d like to manage this feature.

  • If a site has multiple groups with the same permission levels (Owners, Members and Viewers) but there is not an assigned default group, then you will see the problem where access requests will either not display for the impacted user or an owner will not be able to approve requests.

Here’s a Windows PowerShell script to change each of the groups for a site so that each is identified as the default group for Members, Owners and Visitors

You’ll need to a the “Microsoft.SharePoint.PowerShell” add-in at the top of the script to get the SharePoint references.

#Members Group
$web = Get-SPWeb “https://sharepoint.contoso.com”
$groupToMakeDefaultMembersGroup = $web.Groups | ? { $_.Name -eq “Team Site Members” }
$web.AssociatedMemberGroup = $groupToMakeDefaultMembersGroup
$web.Update()

#Owners Group
$web = Get-SPWeb “https://sharepoint.contoso.com”
$groupToMakeDefaultOwnersGroup = $web.Groups | ? { $_.Name -eq “Team Site Owners” }
$web.AssociatedOwnerGroup = $groupToMakeDefaultOwnersGroup
$web.Update()

#Visitors Group
$web = Get-SPWeb “https://sharepoint.contoso.com”
$groupToMakeDefaultVisitorsGroup = $web.Groups | ? { $_.Name -eq “Team Site Visitors” }
$web.AssociatedVisitorGroup = $groupToMakeDefaultMembersGroup
$web.Update()

#Enable Access Requests after it was disabled
$web.RequestAccessEmail = “user@mydomain.com”
$web.Update()

If you turn off the feature, you will can re-enable the feature by adding an email address to the “RequestAccessEmail” property.

Hope this helps solving the problem around assigning default groups and enabling the Request Access feature in SharePoint 2013.