Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have 2 trusted domains. I am able to add those users into local administrator group. But I could not able to search them in CA people picker in 2010?. How to get them into there.

share|improve this question
    
Is the user account actually a security group? –  Wartickler May 4 '12 at 14:34
add comment

1 Answer 1

up vote 2 down vote accepted

SharePoint can use domain trusts and query the other domain(s) for users, but if the domain trust is one-way, you need to explicitly "tell" the specific webapps that it's users can come from other (sub) domains as well. Only bidirectional domain trusts work out of the box.

To tell a web app which (1-way trusted) domains to use, i use the following (modified from here):

Create a domaintrust.ps1 (Powershell) file and copy the following code into it:

    if ( (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue) -eq $null )
    {
        Add-PSSnapin Microsoft.SharePoint.PowerShell
    }

    function Configure-DomainTrusts() 
    {
        <#
        .Synopsis
         Configures 1-way domaintrusts for webapplications specified in an xml file called domaintrusts.xml
        .Description
        XML file should reside in the same folder as this script and be named domaintrusts.xml. 

        The XML format expected is:
         <webApplications>
            <webApplication url="http://webappurl">
                <domainTrusts>
                    <domainTrust domainName="currentdomain.extension" isForest="False" />
                    <domainTrust domainName="trusteddomain.extension" isForest="False" userName="USERNAMEONLY" password="PASSWORD" />
                </domainTrusts>
            </webApplication>
        </webApplications>

        A domaintrust's username should be username only, without the domain. 
        The password can be omitted. If so, you will be prompted for it.

        .Notes
        NAME: Configure-DomainTrusts
        AUTHOR: colin.dekker@dcubed.nl
        KEYWORDS: SharePoint, DomainTrust

        .Link 
        http://www.get-spsolutions.com
        #>

        $executingScriptDirectory = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent
        $domainTrustsConfigPath = "$executingScriptDirectory\domaintrusts.xml"
        $domainTrustsConfigContent = ( Get-Content $domainTrustsConfigPath )
        $domainTrustsConfigXml = [xml] $domainTrustsConfigContent

        $webApps = @()
        $webApps = $webApps + $domainTrustsConfigXml.webApplications.webApplication     #'Cast' to an array, even when there's only 1 element
        $webApps | ForEach-Object {
            $webApplication = [Microsoft.SharePoint.Administration.SPWebApplication]::Lookup($_.url)

            $searchActiveDirectoryDomains = $webApplication.PeoplePickerSettings.SearchActiveDirectoryDomains
            $searchActiveDirectoryDomains.Clear()

            $currentDomain = (Get-WmiObject -Class Win32_ComputerSystem).Domain

            $trusts = @()
            $trusts = $trusts + $_.domainTrusts.domainTrust     #'Cast' to an array, even when there's only 1 element
            $trusts | ForEach-Object {
                $domainName = $_.domainName

                $trust = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
                $trust.DomainName = $domainName
                $trust.IsForest = $_.isForest -eq $true

                if ($trust.DomainName -ne $currentDomain) {
                    $trust.LoginName = [string]::Format("{0}\{1}",$_.domainName , $_.userName)

                    if([string]::IsNullOrEmpty($_.password))
                    {
                        $credentials = $host.ui.PromptForCredential("Foreign domain trust credentials", "Please enter the trust credentials to connect to the $domainName domain", "", "")
                        $trust.LoginName = $credentials.UserName
                        $trust.SetPassword($credentials.Password)
                    }
                    else
                    {
                        $pwd =  ConvertTo-SecureString -AsPlainText -Force  -String $_.password
                        $trust.SetPassword($pwd)
                    }
                }

                $searchActiveDirectoryDomains.Add($trust)
            }

            $webApplication.Update()
        }
    }

    function Set-AppPassword([String]$password) 
    {
        <#
        .Synopsis
         Sets the password SharePoint uses to encrypt credentials used to query a domain specfied as a domaintrust

        .Description
        Takes a password string and sets that as SharePoints ApplicationCredentialKey

        .Notes
        NAME: Set-AppPassword
        AUTHOR: colin.dekker@dcubed.nl
        KEYWORDS: SharePoint, DomainTrust

        .Link 
        http://www.get-spsolutions.com
        #>

        $type = [Microsoft.SharePoint.Utilities.SPPropertyBag].Assembly.GetType("Microsoft.SharePoint.Utilities.SPSecureString")
        $method = $type.GetMethod("FromString", "Static, NonPublic", $null, @([String]), $null)
        $secureString = $method.Invoke($null, @($password))
        [Microsoft.SharePoint.SPSecurity]::SetApplicationCredentialKey($secureString)
    }

    function Set-SearchAppACLs()
    {
        <#
        .Synopsis
         Sets the ForceClaimACLs flag to true on the Farms default search service application
         Needed whenever a webapplication is configured to use 1-way domain trusts. Without this setting, 
         Search will not return any results
        .Notes
        NAME: Set-AppPassword
        AUTHOR: colin.dekker@dcubed.nl
        KEYWORDS: SharePoint, DomainTrust, Claims, ACLs, Search
        .Link 
        http://www.get-spsolutions.com
        #>

        $SearchApp = Get-SPServiceApplication | Where {$_.TypeName -eq "Search Service Application"}
        $SearchApp.setproperty("ForceClaimACLs", 1)
    }

Then, create a file called domaintrusts.xml in the same folder and add the following XML:

<webApplications>
    <webApplication url="http://webappurl">
        <domainTrusts>
            <domainTrust domainName="currentdomain.extension" isForest="False" />
            <domainTrust domainName="trusteddomain.extension" isForest="False" userName="USERNAMEONLY" password="PASSWORD" />
        </domainTrusts>
    </webApplication>
</webApplications>

Add a domaintrust for each of your trusted domains. The user specified should from the trusted domain, enter the name only (so do not write domain\user).

The last 2 functions are needed because:

  • Set-AppPassword, call this function on each server in your farm, otherwise the credentials for a domaintrust cannot be decripted on every machine.

  • Set-SearchAppACLs, for some obscure reason, if this is not done, search will work, but no results will be returned.

share|improve this answer
    
Thanks @colin, It works in peoplepicker. I am able to find trusted domain users in people picker. But in central admin when I am trying to add them as site collection admin (after finding them in peoplesearch) it is giving redline undername name and not allowing to add them. –  James123 May 7 '12 at 15:38
1  
you have to execute the script against the CA too –  Colin May 7 '12 at 17:11
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.