Various options can be leveraged for the authentication in SharePoint. Claims based authentication is the default authentication method in SharePoint. We will go through different types of claims authentication used in SharePoint

What is a Claim?

Definition from source: A claim is a statement that one subject, such as a person or organization, makes about it or another subject.

In the context of SharePoint Authentication, Claim is a statement by a user or a resource to prove its identity.

What is Authentication?

Definition: In simple words, Authentication is the process of checking the user’s identity.

When SharePoint Authentication does occur?

1. If any user tries to access SharePoint resource
2. If any App tries to access SharePoint resource
3. If the SharePoint server tries to access SharePoint resource

There are a few Authentication methods and you can use any of them. We will go through them one by one.

1. Windows authentication
1. NTLM
2. Kerberos
3. Digest
4. Basic
2. Forms-based authentication (FBA)
3. Security Assertion Markup Language (SAML) token-based authentication

Windows Authentication:

In Windows authentication, SharePoint takes advantage of the default authentication provider (ADDS) to authenticate the logged-in user. In this type of authentication, SharePoint site takes the same credentials, which was used by the user to log in to his machine.

1. NTLM
2. Kerberos
3. Digest
4. Basic

Windows claims Authentication process in SharePoint

1. Assume, on client’s computer there’s no any claims-based security token, User requests SharePoint resource (Site, list, page, etc.…).
2. SharePoint asks the user for the credential.
3. The user provides the credentials.
4. SharePoint takes the credentials and goes to the identity provider to verify the credentials
5. The identity provider will verify the credentials and will send back the Windows Security Token.
6. SharePoint asks Domain Controller for the list of Security Groups that the user belongs to.
7. Domain Controller sends the list of Security Groups to SharePoint
8. Using this information (Windows Security Token and Group Membership of the user account), Security Token Service in SharePoint server creates claims-based Security Token.
9. Security Token Service (STS) stores claims in Distributed Cache Service (DCS) in SharePoint farm.
10. IIS server on the SharePoint server sends authorization code to the client computer.
11. The end-user accesses the page if the user is authorized, through analysis of the claims in the security token and configured permission.
12. After authorization is successful, the SharePoint server sends the content of the page.

Note: Authorization code is used for authentication of any subsequent requests.

Forms-based authentication (FBA)

Form-based authentication is a process of checking the user’s claim based identity with the help of ASP.Net membership and role provider. You can use Forms-based authentication if the user credentials are stored in one of the below authentication providers.

• ADDS
• SQL Server or equivalent database
• Lightweight Directory Access Protocol (LDAP) datastore

Forms-based claims Authentication process in SharePoint

1. Assume, on client’s computer there’s no any claims-based security token, User requests SharePoint resource (Site, list, page, etc.…).
2. SharePoint sends Form-Based login page to the user and asks the user to enter credential.
3. The user provides the credentials.
4. SharePoint sends the credentials to Membership Provider.
5. Membership Provider verifies the credentials
6. SharePoint queries Role Provider for the credentials (user)
7. Role Provider sends the list of Roles that are associated with the user
8. Based on Information from Membership and Role Provider, Security Token Service in SharePoint server creates claims-based Security Token.
9. Security Token Service stores claims in Distributed Cache Service (DCS) in SharePoint farm. Claims in Security Token include user identity and the roles of the user account.
10. IIS server on the SharePoint server sends Federated Authentication or Fed Auth Cookie to the client machine.

The cookie contains encrypted key or index to the security token (which is created in SharePoint server in Distributed Cache Service - DCS).

11. The end-user accesses the page, If the user is authorized, through analysis of the claims in the security token and configured permission.
12. After authorization is successful, the SharePoint server sends the content of the page.

Fed Auth Cookie is used for authentication of any subsequent requests.

Security Assertion Markup Language (SAML) token-based authentication

SAML based authentication process includes:

(1) User: The end-user who requests the content/data.

(2) SharePoint Server: The SharePoint server where the actual data is available.

(3) Identity Federation server such as ADFS (Active Directory Federation Services): ADFS is a Microsoft component developed for Single Sign-On Solution (SSO) especially when the users are not capable of accessing the application using Integrated Windows Identity (IWA) through Active Directory (AD).

(4) Identity provider - ADDS (Active Directory Domain Services): which contains id, password and other details of the objects/users.

Trust Relationships - Security Assertion Markup Language (SAML) token-based authentication

1. Identity Federation server (ADFS here) should establish TRUST with Identity Provider (ADDS here) for which ADFS is issuing SAML security tokens.
2. Identity Federation server (ADFS here) also needs to TRUST security token requests for locations on the SharePoint server.

   For this, you need to configure ADFS with SharePoint Web Application URLs as Relying Parties. The idea behind this is to trust pages within those Web Application URLs for SAML security token requests.

3. SharePoint Server needs to TRUST the Identity Federation server (ADFS here).
   1. ADFS uses the certificate to sign the security token that it issues.
   2. SharePoint server needs a public key of that certificate to validate the digital signature on the security tokens issued by ADFS server.

Security Assertion Markup Language (SAML) token-based authentication process

1. Assume, on client’s computer there’s no any claims-based security token, User requests SharePoint resource (Site, list, page, etc.…) and SAML Authentication process starts with this request.
2. SharePoint server redirects the user (client computer) to the Identity Federation server (ADFS here) server to obtain SAML-based login page.
3. The user enters credentials in the login page and sends back to Identity Federation server (ADFS here) server and requests SAML security token
4. Identity Federation server (ADFS here) sends credentials to Identity Provider (ADDS here)
5. Identity Provider (ADDS here) confirms credentials and send a reply to Identity Federation server (ADFS here)
6. Identity Federation server (ADFS here) then creates a SAML token for the user, signs it and send it to the user.
7. The client computer sends a fresh request to SharePoint resource (Site, list, page, etc.…). This time SAML security token is also included in the request that it got from the Identity Federation server (ADFS here).
8. Security Token Service in SharePoint server creates claims-based Security Token from SAML security token received from the Identity Federation server (ADFS here).
9. Security Token Service stores claims in Distributed Cache Service in SharePoint farm
10. IIS server on the SharePoint server sends Federated Authentication or Fed Auth Cookie to the client machine.

The cookie contains encrypted key or index to the security token (which is created in SharePoint server in Distributed Cache Service).

11. The end-user accesses the page if the user is authorized, through analysis of the claims in the security token and configured permission.
12. After authorization is successful, the SharePoint server sends the content of the page.

Fed Auth Cookie is used for authentication of any subsequent requests.

Conclusion:

We went through each claim based authentication process in details which is used in SharePoint.

You can go through the Microsft article about SharePoint Authentication Overview in detail.