SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a need to handle two unique authentication scenarios:

  • "Off network" - provide a login form (Forms based auth)
  • "In Network" - traditional windows auth / no form

This is the same user base - all Active Directory users. I can do this in SharePoint easily by enabling multiple authentication providers - however, I've essentially created two identities that I need to maitain security on - for the same person.

Is there a way to "merge" the identity coming back from the LDAP provider so SharePoint treats it like the Windows Identity?

Any ideas would be great!

share|improve this question

Out of the box no. You would need to create custom code or script that runs thru and captures your LDAP user permissions than assign those to the windows user.

Third party administrative products like Axceler ControlPoint and AvePoint DocAve, have this ability. While they are great tools, it's not very cost effective to deploy them for this single reason. Have a look at using a proxy like Microsoft Threat Management Gateway (or other that will support Kerberos constrained delegation)? You could use forms authentication with KCD, thus keeping all your users tied to AD objects.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.