Interact Intranet: Extranets & Authentication

As we dig under the covers during our migration from Plumtree (aka Oracle WebCenter Interaction) to Interact Intranet one of the areas of greatest interest is the relationship between the intranet & extranet instances. In particular how authentication is handled between Active Directory and the intrinsic user repositories, along with the use of Windows Integrated Authentication (WIA).  It took me some time to get all the answers I needed, and I still have a long way to go to understand the system, but I hope this helps those looking to have both an intranet & extranet.

AD Logins
The only way to login to Interact using an AD account is via WIA.  This shouldn't be an issue on the intranet side as IE users will be automatically authenticated.  Logging out of an account and logging back in (for test or other reasons) will cause issue as users will likely assume that they can login via the standard webpage form, but unfortunately they'll get an error if they try that and will need to trigger the actual login page (slightly different from the page you are taken to on logout).  

The workaround to the auto-authentication via WIA is to not set your security zone, that way you are always prompted to login.  There isn't a workaround for a standard user, just hope they never logout while on your domain.

Intrinsic Logins
Only accounts with an Interact username & password can use the standard webpage form.  This holds true regardless of whether they are attempting to login on the intranet or extranet side of the fence.

AD + Intrinsic 
All profiles, including those created via AD, have a username and password section.  You could create a script to copy all AD username and passwords into these intrinsic field for pre-populated users.  Interact doesn't have a utility or script to do this, but I'm sure it could be done with some external consulting assistance.  If you do this please let me know!!!


URLS
Interact informed me that in IE7 it isn't possible to have both WIA and anonymous login for a particular site.  This means that you'll need different URLs for your AD and Intrinsic logins, one set for anonymous and the other for WIA.  Having used multiple URLs to point at a single portal instance in the past I know this can be daunting and cause many unforseen problems with applications pointing to hardcoded paths.  I wish there were a better solution to this issue and if anyone reading this has a recommendation please let me know!

Synchronize Your Sites

If you do setup an intranet and extranet environment you'll need to synchronize your front end files.  To do this you can use a utility like Robocopy which is very simple to configure.