Why are SharePoint permissions shared across zones

Question

I have a SharePoint 2010 webapplication with 2 zones with different claims based authentication providers:

Default zone: Windows authentication (Kerberos) Extranet zone: Custom claims provider

Why is it that if I add an AD user on the default zone I can see that users permissions if I go to the Extranet zone, are permssions shared across zones?

If yes does that mean that if I have multiple zones with the same authentication provider I cant give different permissions on different zones?

Thx

Answer 1

Yes, When you extend a SharePoint web application, you are telling SharePoint to go to IIS and create a new site, but SharePoint will use it to show the same content. You would normally do that to support different security, authentication and URLs between an Internet site, Intranet and Extranet, for example.

The purpose of alternate access mappings is to deal with the situation where you have a load balancer or a proxy server that translates from an external URL to your server's internal URL. This ensures that the relative URLs generated by SharePoint when rendering pages are consistent with the external URL. Configuring alternate access mappings does not automatically add host header entries.

Whats the difference between host headers and alternate access mappings?