Understanding SharePoint 2010 Extranet Security

Understanding the SharePoint security model requires understanding the difference between the authentication process and authorization process. Authentication is the mechanism whereby systems securely identify the user attempting to access a resource. Authorization is the mechanism by which a system determines the level of access the authenticated user or identity has to a secured resource. The authorization process requires that the authentication process succeeds and establishes an identity. SharePoint itself does not perform any authentication; the authentication process is handled by an underlying authentication system. For example, Windows authentication is handled by Windows server and Internet Information Services (IIS). SharePoint performs the authorization to secured resources contained in sites, lists, libraries, and other such containers. SharePoint 2010 offers two different authentication modes natively: classic authentication mode and claims-based authentication mode.