Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have set up a test system to evaluate the use of AD LDS in an extranet scenario. I have a Windows 2008 R2 server with Sharepoint 2010 SP1 installed. This machine is joined to an AD domain, and has the AD LDS role enabled. I have created a claims based auth site, supporting both windows auth and forms. I have configured the providers as follows:

Central Admin

<roleManager defaultProvider="AspNetWindowsTokenRoleProvider" enabled="true" cacheRolesInCookie="false">
  <providers>
  </providers>
</roleManager>
<membership defaultProvider="LdapMember">
  <providers>
    <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider,&#xD;&#xA; Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral,&#xD;&#xA; PublicKeyToken=71e9bce111e9429c" server="localhost" port="6000" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="cn" userContainer="CN=Users,CN=FAPartition,DC=sharepointpoc,DC=COM" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
  </providers>
</membership>

STS

<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
  <providers>
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
  </providers>
</roleManager>
<membership defaultProvider="LdapMember">
  <providers>
    <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider,&#xD;&#xA; Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral,&#xD;&#xA; PublicKeyToken=71e9bce111e9429c" server="localhost" port="6000" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="cn" userContainer="CN=Users,CN=FAPartition,DC=sharepointpoc,DC=COM" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
  </providers>
</membership>

FBA Application

<membership defaultProvider="i">
      <providers>
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
        <add name="LdapMember" type="Microsoft.Office.Server.Security.LdapMembershipProvider,&#xD;&#xA; Microsoft.Office.Server, Version=14.0.0.0, Culture=neutral,&#xD;&#xA; PublicKeyToken=71e9bce111e9429c" server="localhost" port="6000" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="cn" userContainer="CN=Users,CN=FAPartition,DC=sharepointpoc,DC=COM" userObjectClass="user" userFilter="(ObjectClass=user)" scope="Subtree" otherRequiredUserAttributes="cn" />
      </providers>
    </membership>
    <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">
      <providers>
        <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
      </providers>
    </roleManager>

I have also added the wildcard configuration into the central admin config file

<PeoplePickerWildcards>
   <clear />
   <add key="AspNetSqlMembershipProvider" value="%" />
   <add key="LdapMember" value="*"/>
</PeoplePickerWildcards>

I have added my SharePoint service account to the Readers role in LDS, and am able to connect using the service account credentials through ADSI Edit.

No LDS users appear in the people picker, only AD domain users.

I am able to log in using an account in AD LDS, but just get access denied because I cannot assign rights to the user.

share|improve this question
    
Does it work when you type the full account name in a people picker field? That should work if its just something wrong with the wildcard search. –  Anders Aune Dec 16 '11 at 13:18
    
Doesn't seem to work with the full value of cn. –  AlexWilson Dec 20 '11 at 11:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.