NTLM Authenticated Application, FBA, and the People Picker

Question

On the Windows Authenticated side of an extended web application with FBA, the people picker is only working when I also enable FBA through Central Administration for the Windows Authenticated web application.

When I enable FBA on the web application like so:

The people picker will pick up the FBA users without a problem. However, with both modes of authentication enabled, when you navigate to the Windows Authenticated site, you get a dropdown to choose your method of authentication rather than having the Windows credentials passed through:

Disabling FBA in the Edit Authentication modal allows the credentials to pass through, but you can not select FBA users in the people picker.

It's interesting to note that switching FBA on or off here has no effect on the web.config file.

Relevant web.config is set up as such:

<PeoplePickerWildcards>
  <clear />
  <add key="AspNetSqlMembershipProvider" value="%" />
  <add key="FBAMembershipProvider" value="%" />
</PeoplePickerWildcards>

<membership defaultProvider="i">
  <providers>
    <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="FBAMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" applicationName="/" connectionStringName="FBADB" enablePasswordReset="true" enablePasswordRetrieval="false" passwordFormat="Hashed" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" />
  </providers>
</membership>
<roleManager cacheRolesInCookie="false" defaultProvider="c" enabled="true">
  <providers>
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="FBARoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" applicationName="/" connectionStringName="FBADB" />
  </providers>
</roleManager>

<connectionStrings>
  <add connectionString="Blah Blah Blah - This Works" name="FBADB" />
</connectionStrings>

The question is, how can I get the people picker to work without prompting the user to choose an authentication method at the time of login?

Answer 1

You may also notice that on the "real" FBA zone, if Windows Authentication is disabled, the People Picker won't show AD users either. So you're correct that in order to pick users from the underlying repository, authentication for that repository must be enabled.

You can try using http://spautomaticsignin.codeplex.com/ if you want to automatically sign in with Windows Auth on the internal zone (even if FBA is enabled).

The and sections of the web.config files are never modified by SharePoint when you enabled or disable FBA, and you always have to do those modifications yourself. You're also correct that the FBA settings in web.config don't have any impact if FBA authentication is not enabled on that zone.

Answer 2

For posterity, I resolved this in the following manner:

Captured network traffic with the developer tools and watched for the URL to the login page (which is different for either form of authentication)

In Central Administration > Manage Web Applications > clicking Authentication Providers in the ribbon presents the Edit Authentication dialog as seen in OP.

Scroll to the bottom of the Edit Authentication modal dialog to the section titled "Sign In Page URL" and select "Custom Sign In Page."

For the FBA authenticated extended web application use /_forms/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

I had to create a custom login page for the NTLM authenticated web application, as using this same method to redirect to /_windows/default.aspx?... is inconsistent and breaks sign out. It only authenticates about 50% of the time, and throws an error the other 50%. I didn't figure out what the cause was, but the error generated is a NullReferenceException in the method SPClaimProviderManager.DecodeClaimFromFormsSuffix().

After creating the custom NTLM login, I set the "Custom Sign In Page" to my new custom page.

This will cause the appropriate login page for the chosen authentication method for each web application to default to the appropriate page.