SharePoint 2010 Publishing Sites and Mobile Views Authentication Issue

During testing of a SharePoint 2010 public facing website we noticed that when using mobile devices anonymous users were getting authentication prompts. Not good! The intended behaviour was to send users to the standard view of the website but SharePoint was detecting mobile browsers and redirecting to the mobile view of the site. We ended up modifying the compat.browser files as pointed out by Randy Drisgill so that all users on all devices got directed to the standard view. It got me thinking about if the out of the box mobile views could ever be used with SharePoint 2010 WCM solutions, and I’m afraid my conclusion has to be probably not!

The closest I could find to others people experiencing the issue was on this TechNet discussion, and also being able to confirm the issue on other public SharePoint sites (e.g. try ?Mobile=1 on http://sharepoint.microsoft.com). To track down what was causing the authentication prompt I created an out of the box Publishing Portal site collection and then enabled anonymous access for it in an extended web application. By forcing my browser to hit the mobile view of a page (by appending ?Mobile=1 to the URL) I could see from Fiddler that I was being redirected to a layouts page at /_layouts/mobile/mblwp.aspx. It seemed to be this page that was returning a 401 error and prompting for authentication.

So a publishing site and an error when hitting a layouts page – that has to be the lock down feature right? It turns out that it was and here are the steps I followed to confirm it.

I created four site collections from a Blank Site, Team Site, Enterprise Wiki and Publishing Portal templates. I then enabled anonymous access on all of them. By hitting the mobile views of the home page for each of these sites I was able to see that the blank site and team site functioned well for anonymous users; however both the enterprise wiki and the publishing portal prompted for authentication. I then used PowerShell to list the activated features and confirm that both of these sites had the site scoped ViewFormPagesLockDown feature enabled on them, and that the other two did not.

So everything was going as expected here. Deactivating the feature must surely now open up the mobile view. I used PowerShell to deactivate the feature on my publishing portal like so:

Disable-SPFeature -Identity "ViewFormPagesLockDown" -URL http://anon/sites/publishing

So closing my browser (and doing an IISReset, just for luck!) I hit the site with ?Mobile=1 again expecting to see the publishing site. Authentication prompt. Hmmm. At this point I started to think about going back to the drawing board and was wondering if there could be other interferences from the SharePoint Server Publishing Infrastructure feature. Before going too far down this road however thankfully I had an idea that simply deactivating the feature may not have been enough to fully ‘undo’ its effects. I went back into the anonymous site as an administrator and re-applied the anonymous access settings.

Now hitting the mobile view on the publishing site redirects me to the mobile view with no authentication prompts. Success! So I was able to confirm that it was the lock down feature that was causing the authentication prompts when hitting the mobile view on a publishing site.

Whilst deactivating the feature has helped me track down this as the route cause (in my development environment) it is certainly not something that I would recommend on a production system. I have to conclude therefore that the out of the box mobile views cannot be used with SharePoint 2010 web content management solutions. I guess some further work could be done to grant anonymous users access just to the /_layouts/mobile folder in the SharePoint Root, however in my scenario I think it’s more preferable to direct the users to the full site in any case.

share and enjoy
  • Print
  • Twitter
  • Digg
  • del.icio.us
  • StumbleUpon
  • Yahoo! Buzz
  • Google Bookmarks
  • Facebook

9 comments to SharePoint 2010 Publishing Sites and Mobile Views Authentication Issue

  • Eric VanRoy

    Thank you for doing my work for me. That was the exact path I was heading for and you confirmed it wast the lock down feature. I agree with you about opening it up, but now I need to come up with a quick and easy work around.

    I did see another article that explains how to tell SharEPoint the device is not mobile and then renders the normal page, but I am not sure I like that either.

    Any thoughts?

  • glynclough

    Hi Eric, I’m glad you found the post helpful. In my scenario using the normal page view on a mobile device was an appropriate workaround and so that’s where we ended up going.

    For a more robust workaround to allow anonymous to access the mobile view I think that you’d somehow have to single out those /_layouts pages that are required and exclude those from the lockdown feature. As I’m not exactly sure how the lockdown feature achieves what it does though I’m not sure where to start with this! If I find out anything I’ll respond here.

  • moataz moussa

    can anyone help me? I need to disable mobile access for the admin site in sharepoint 2007. How can I do it?

  • Stephanie

    Hi Glen,
    Currently I have been tasked to create a mobile version of my company’s publishing portal that used custom branding. After studying the Out of the Box mobile site functionality offered by SharePoint, I realized that it is very limited for a full fleged publishing site. For example, I could not attach a custom external stylesheet as well to mobile version site.

    I would liek to know what is the good practice to create a mobile version of a publishing portal site. I saw a few mobile sites like m.volvocars.com. It seems that people use custom sites for mobile version instead of going for out of the box mobile solution. Is this coorect approach? Please advise.

  • Anyone know if this is a problem on public facing sites for SharePoint Online on Office 365?

  • Hi Glyn, Great post thank you. You have said “it is certainly not something that I would recommend on a production system”. I have a publishing site set as its own web application in SP2010 that I intend to use as a public website . In this situation would your fix still be a bad idea?

    I understand that it might be a bad idea if you have other site collections under one web application that you may not want to deactivate the feature on, but on a standalone web application I wonder if it is not such a bad idea.

  • […] to Glyn Clough’s I now have an explanation of the why (cf. feature in his reverse engineering tests) and thanks […]

  • Joyce

    Hello!!!! I´m using the sharepoint 2013 and i´m having the same problem.

  • Hi Glyn – This is just a note of appreciation for sharing your tests. I am running into these same issues and it was nice to find your post. I will probably end up disabling mobile and I will be looking into adding additional *.browser files to the App_Browsers directory instead of editing the compat.browser file. I hate to edit the system files that can be modified during the patching process.

Leave a Reply

You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>