Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We had an existing web application using classic mode authentication. We changed the existing site to use Claims based authentication for Windows accounts and enabled Forms Based Authentication (FBA) by following this LINK.

After following this I am unable to log in with windows account. I am getting access denied error.

If I am adding domain users group into USER Policy with Full read access permission, then users able to log in with windows account. Even after adding this, I am opening any New Items in our custom lists showing New users need to Fill the form.

I need to fix this for existing users so they can use their same account without adding them into the USER Policy so they get same manage permissions as when the web application was in classic mode authentication.

or

In case if we are giving permission for domain users on USER Policy also, users should get log in permission and site permission as they had earlier.

For this what I need to change or What I need to do. Can you please anyone help me.

Thanks & Regards, Sree

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

You state in your question that your SP2010 Web Application was using Classic mode and you migrated it to Claims-based authentication using Windows NTLM. At the same time, you also enabled Forms Based Authentication.

The article you referenced in your question is for a new web application using Claims with both Windows and FBA authentication. The web application in this article never was configured to use classic mode.

This is not your situation as you are migrating from an existing web application where classic authentication is already enabled. The article you need to follow is here Part 2 with Part 1 located here as a reference. The MigrateUsers method on the SPWebApplication object is needed to convert the users to Claims mode. Powershell commands in the article explain how this is done.

share|improve this answer
    
Hi Rich, Thanks for your needful Reply. I will go through that links and check my web application. –  Sree Oct 12 '11 at 12:34
    
Now My question is, In that web application (Default Zone) can I configure FBA with AD also after migrating to claims based. –  Sree Oct 12 '11 at 12:46
    
If by "FBA with AD" you mean a web application with a default zone that uses both Windows and Forms Authentication, then yes this is possible. I have configured web applications to do this and it works very well. –  Rich Ross Oct 12 '11 at 13:06
    
Thanks for your Reply... Let me do test, Existing web application migrating classic mode to claims based Authentication. –  Sree Oct 15 '11 at 13:23
    
Thanks Rich... I have tested its working fine. I have small doubt. Claims based user(domain\Testuser) and AD membership form user(Testuser) will be different account. –  Sree Oct 21 '11 at 16:21
show 3 more comments

If I understand you correctly, you just disabled Windows authentication in favor of Claims/FBA, in which case you will need to add users using those authentication providers as the source. Your site no longer honors Windows Authentication so it is responding as it should. If you need to access the same content via Windows Authentication then you may need to extend the web app again and set the authentication provider for the extension to Windows.

share|improve this answer
    
I couldn't get your point. I had a Default zone site with classic mode. I have changed to Claims based with FBA. After doing this we couldn't login with AD users account Domain\user1. It was showing Access Denied. For solving / testing this I added domain users group into USER Policy with Full Read access. Then domain\user able to login the site. Now my question is without extending the existing site, we cannot use both logins? –  Sree Oct 11 '11 at 11:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.