Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Been mulling something over with regards to CBA in 2010.

Suppose that I have a trusted IdP. A user authenticates against the IdP and enters my SharePoint site for the first time.

Unless the user has already been given a role assignment, the user won't have access to the site. Seems like a Catch-22 (or am I wrong?). Q1. Would it be possible to provision the SPUser and the role assignments without building a custom MembershipProvider? I am assuming this is a "No" and that a custom MembershipProvider and access to query the IdP's membership store is required. More generally, how does a CBA user get access to the site in the first place?

Now suppose my IdP also provides a series of claims regarding the user. For example:

  • Email
  • Display Name
  • Country
  • Project
  • Role

And based on the claims, I would like to use custom code to automatically build the role assignments when the user first logs into the SharePoint site. For example, a user with claims {Country=US,Project=PROJ1,Role=Manager} would be provisioned to a sub-site for "PROJ1" in the group "US Managers".

From what I understand, the correct way to do this would be to implement a custom Microsoft.IdentityModel.Claims.ClaimsAuthorizationManager and inserting that into the request pipeline to provision the role assignments automatically in custom code from the claims. The CAM would execute before SharePoint in the request pipeline and thus it would have a chance to provision the user to the site.

Q2. Is this the best way? Or is there a simpler solution/alternate extension point?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

How does a CBA user get access? In claims mode, the ACL does not necessarily store user ids as you see in NT/FBA scenarios. It stores the provider, claim type and value. Then, any user with a claim from that provider that has a matching value for the claim type will be granted access. The claim information is entered via the people picker, or what I call the "Claims Expression Editor" (TM).

I demo this concept as part of the claims talk on Channel 9: http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/OSP308 (about 40 minutes in).

In your example, in sub-site "PROJ1", you would search for "US Managers". Then, expand the IdP on the left, select the "Role" node, then click on the entry in body of the control. Then click Add.

You do not need to write custom code to do this.

share|improve this answer
    
Paul, the info is helpful; however, it should be noted that for the Claims Expression Editor (TM) to be more useful, one will likely need to implement a custom SPClaimProvider to support the "claim picker" –  Charles Chen Feb 17 '12 at 16:54
    
Well, "more useful" is subject to interpretation and was not part of the question. :-) I do address that in the session at that link. –  Paul Schaeflein Feb 17 '12 at 17:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.