SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've finally managed to get my SharePoint system up and running so that it authenticates users with Kerberos and successfully passes that authentication along to a back-end WCF service. All end-users and the SP accounts are in the same domain; the WCF service is running as Network Service.

The back-end service is logging the claims present in every request, and shows claims for name, primarysid, primarygroupsid, several groupsid, authenticationmethod (blah/windows) and authenticationinstant. However, I'm told it will also require a upn claim containing the user's UPN.

How can I get this to happen? I've tried playing with the External System settings in SPD, and changing the web.config for the WCF service. (The service isn't under my control, but they've provided a copy for me to play with and I'll be feeding back any necessary changes.) Nothing seems to affect the list of claims, except when I screw it up enough that the request starts coming from one of the SP domain accounts rather than the user.

share|improve this question

At first you should have UPN enabled in your AD. Did you try that:

share|improve this answer
Everything here is happening inside one domain, inside one company - is ADFS relevant? – Rawling May 18 '11 at 15:17
up vote 0 down vote accepted

We ended up setting BDC to not authenticate at all (Anonymous), and setting the WCF service to trust SharePoint as a token source; after this, everything works. We probably had the wrong end of the stick.

share|improve this answer

I am not quite sure if understand your scenario correctly but it sounds like you intend to delegate to a claims enabled WCF service. In that case (although you found a work-around) you might to check out this article:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.