I have a claims-based web application that is accessed by two groups of users -- a group of anonymous users and a group of users from an AD domain who manage and create the content in the site.
I have extended the web application into the Internet zone (http://www.example.com). Anonymous users access this zone while the Windows users access the default zone (http://default). Originally I had the Internet zone allow only anonymous authentication
(i.e. no authenticated users can access the Internet zone) and the default zone allows only Windows authentication. From an authentication perspective, this works. Anonymous users hit http://www.example.com and access the site anonymously, and Windows users
hit http://default and are challenged for their credentials (http://default is in the local Intranet zone so as to pass the logged in user's credentials automatically).
However, with this configuration, Search does not work for anonymous users. All their searches return no results. Eric Shupps describes this behaviour in his post,SharePoint 2010 Anonymous Search Results. The solution is to enable anonymous access in the Default zone. By enabling anonymous access in the Default zone (which includes defining
the
SPWebApplication.ZonePolicies AnonymousPolicy to be
DenyWrite), anonymous users can now see search results.
With this configuration however, we now have the issue where internal users access http://default and log in anonymously. Occasionally reloading the page will log the user in and appending /_windows/default.aspx to the URL will force a Windows authentication.
This is not desirable, the AD users should always be forced to log in and should never access the default zone anonymously.
Is there a way to force this? Keeping in mind that disabling anonymous or setting the Default zone's AnonymousPolicy to DenyAll also stops search results from appearing for anonymous users.
I have also tried creating a second extension into the Intranet zone (http://intranet) that allows only Windows authentication to be used by the AD users. The default zone allows anonymous and Windows authentication (the Default zone URL http://default is
used for indexing) but blocking anonymous in the Intranet zone results in search breaking for anonymous users in the Internet zone as well.
Maybe I'm missing something?
Farm configuration:
SharePoint Server 2013 Standard Edition, with March PU (build 15.0.4481.1005)
This issue can be reproduced with the following farm topologies: single server (SP/SQL on one server), 3 server farm (WFE, APP, SQL), 5 server farm (2 WFE, 2 APP, 1 SQL)
One web application in the farm
Services: Search, Metadata, State, Session State, Distributed Cache
Jason Warren
Infrastructure Architect