Search Service Account and Custom STS

Question

We have a custom STS implementation we are using in the company. SharePoint 2010 has a trust relation with this STS and all the websites (except central admin) is authenticated/authorized with this custom STS. All sites except central admin is claims based authentication sites.

The problem we are having is with the search crawl service account. In the central admin, when I try to change the service account, it only accepts windows AD accounts. We try extending the site and make the extended site windows authenticated site, however this time , crawler crawls the documents but does not differenciate the documents from different site collections within the site (for filtering). Anyone has any ideas?

Answer 1

Have you tried using the Server Name Mappings? I've done the reverse with an extended site we have, so content from there looks like what we have in the regular site. I tried to have what you see by default but I had to go through hoops to get that, I'd like to know how you have this just happen.

Answer 2

Could it be that the search app should store it's ACLs as claims too:

$searchapp = Get-SPEnterpriseSearchServiceApplication
$searchapp.SetProperty("ForceClaimACLs",1)

P.S. This is NON REVERSIBLE! So test on test environment first!