2

We have a SharePoint web application with both ADFS 2.0 and NTLM authentication methods enabled. Users have connected SharePoint calendars to Outlook and the integration almost works perfectly. They can connect calendars, they can create/modify/delete events, but:

  • If user has "Automatic logon only in Intranet Zone" enabled in IE settings, user (apparently) gets authenticated using their ADFS credentials (SAML)

  • So when new calendar event is created from Outlook (to SharePoint calendar) the Creator of the event is i:05.t|saml provider|[email protected] which is incorrect

  • Only when they explicitly sign in using Windows credentials (IE security setting is set to "Prompt for user name and password") user gets logged in using NTLM credentials and the identity is correct

We have implemented a simple autosignin.aspx and it contains logic that if URL of the request is either coming through Default or Custom Zone, it will automatically redirect to using Windows authentication provider; otherwise it will display the default authentication method drop down. This autosignin.aspx page is never shown for users when they use Outlook integration so it would seem that NTLM authentication is used.

We're using IE 8.0.7601.17514, Update version: 0.

How would you suggest I would start investigating this issue futher?

Below is the autosignin.aspx just in case although I'm not sure if it can be related to this issue.

protected override void OnLoad(EventArgs e)
        {
            if (SPContext.Current == null) return;
            if (SPContext.Current.Site == null) return;
            if (SPContext.Current.Site.WebApplication == null) return;
            SPWebApplication app = SPContext.Current.Site.WebApplication;

            SPAlternateUrl u = app.AlternateUrls[Request.Url];
            SPUrlZone zone = u.UrlZone;

            string components = Request.Url.GetComponents(UriComponents.Query, UriFormat.SafeUnescaped);

            SPIisSettings settings = app.IisSettings[zone];

            // Redirect internal users to Windows authentication
            if (zone.ToString().Equals("Default") || zone.ToString().Equals("Custom"))
            {
                string targetProvider = "AD";

                foreach (SPAuthenticationProvider provider in settings.ClaimsAuthenticationProviders)
                {
                    if (string.Compare(provider.DisplayName, targetProvider, true, System.Globalization.CultureInfo.CurrentUICulture) == 0
                        || string.Compare(provider.ClaimProviderName, targetProvider, true, System.Globalization.CultureInfo.CurrentUICulture) == 0)
                    {
                        string url = provider.AuthenticationRedirectionUrl.ToString();

                        if (provider is SPWindowsAuthenticationProvider)
                        {
                            components = EnsureReturnUrl(components);
                        }

                        SPUtility.Redirect(url, SPRedirectFlags.Default, this.Context, components);
                    }
                }
            }
        }

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.