SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a user that is logged into SharePoint via Claims Authentication and a custom STS. This provides the following claims:

I need these users to be authenticated in some way against Active Directory also, because they need to access data that is held within Microsoft Analysis services. Is this where it is appropriate to try and set up impersonation with kerberos in some way? The claims windowsaccountname and mail should correspond to those within the user's corresponding AD account, so is this at all possible?

share|improve this question

Note that only Windows claims accounts can be used in delegation scenarios. AS requires delegation properly configured and the reason for the previous constraint is the C2WTS process that converts claims to windows tokens. In SharePoint only Windows claims can be converted to Windows token. That was some background...

So, you should use the SharePoint STS if you need this delegation for AS.

share|improve this answer

You can get a Windows user token from claims using the Claims to Windows Token Service (which is a windows service) - here is an example on how to use it:

I am not sure how good an approach this is...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.