Forum Discussion

Benjamin Bartels's avatar
Benjamin Bartels
Copper Contributor
Oct 12, 2017

I need a guide for SP2016 on prem setting up WAP and ADFS

I have a typical SP2106 on prem site as an intranet and would like to set up Web Application Proxy to allow external employees to access the SharePoint system.  The ADFS and WAP servers are establish...
2016
ADFS
sharepoint server
WAP
Trevor Seward's avatar
Trevor Seward
MVP
Oct 12, 2017
It's a simple process, but to start with, are you going to use SAML on your SharePoint Web Application(s) or are you going to use Windows auth (NTLM or Kerberos) instead? I prefer the latter myself.
MIS Department's avatar
MIS Department
Copper Contributor
Oct 27, 2017

Hi Everyone. My name is Carl and I am working with Benjamin who started the post earlier.


We would like to allow external access to our on-prem SharePoint 2016 on Windows Server 2016.

We have a Windows Server 2016 system configured for WAP setup in a DMZ.

We also have a Windows Server 2016 system with ADFS 4.0 on our LAN.


We would prefer not to join our WAP server to the domain.

What are the methods for WAP and ADFS to do this?

 

If we are using WAP and SAML to pre-authenticate external access can we still use WIA for internal users?

  • Trevor Seward's avatar
    Trevor Seward
    MVP
    Oct 27, 2017

    You can either use WIA which requires joining WAP to the domain or use SAML which does not require joining WAP to the domain. To SharePoint, even with the same User object in Active Directory, a user is different if using Windows or SAML. There is no way to "attach" the user objects together.


    I'd strongly suggest converting all Web Applications to SAML should you choose to use SAML. Mixing WIA and SAML generally doesn't work out too well. This will also prevent duplicate User Profiles (one Windows Claims, the other SAML) which can lead to failures in OAuth-based applications such as Workflow Manager.

     

    And of course there are user experience issues with SAML, such as resolving anything typed into the People Picker. Tools like LDAPCP help with this, but IMO the experience still isn't as good as WIA.

    • MIS Department's avatar
      MIS Department
      Copper Contributor
      Nov 09, 2017

      I would like to know more about the negative user experience you get when using SAML. I noticed this warning in a few other threads as well.

       

      Do you know any blogs/resources that discuss these issues?

       

      BTW - I'm just a generic IT person who is trying to help the actual SharePoint guy get what he needs. 

Resources