SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm facing a problem with my forms authentication that has consumed me some good hours.

My forms authentication points to 2 providers. Both are AD using a ldap connection to diferent domains.

I have the following provider configuration on my web.config

<membership defaultProvider="AD">
    <add name="AD" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADService" connectionUsername="domain1\Admin" connectionPassword="Password" connectionProtection="None" attributeMapUsername="sAMAccountName" enableSearchMethods="true" />
    <add name="AD2" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADTeste" connectionUsername="domain2\Admin" connectionPassword="Password123" connectionProtection="None" attributeMapUsername="sAMAccountName" enableSearchMethods="true" />

PeoplePicker is unable to find users from the second connection. I already added the provider, but still have the problem. Does anyone have an idea what i'm missing ?

Here follows my on web.config

  <clear />      
  <add key="AD" value="%" />
  <add key="AD2" value="%" />
share|improve this question
Do you have both of your connection strings in place? – RJ Cuthbertson Sep 25 '12 at 14:03
My connection strings can be found below the </SharePoint> tag. They were tested by my custom login page, which uses the connection string to autenticate the users Follow the cs: <connectionStrings> <add name="ADService" connectionString="LDAP://,DC=org,DC=br" /> <add name="ADTESTE" connectionString="LDAP://,DC=org,DC=br" /> </connectionStrings> – Pablo Bertrão Sep 25 '12 at 17:47
up vote 1 down vote accepted

Just solved the problem.

My SharePoint farm is installed on domain which provider AD points to. I did the following steps to solve it:

1º Change the default provider in the original web application to AD2.

2º On the extended web app, I changed the default provider to AD.

Now, peoplepicker is able to find the users from both domains.

Thank you for all the comments

share|improve this answer

You would need to add that connection string in 3 places on your farm (beware of multiple WFE as these manual changes require manual input in all WFE!) - Central Administration, Web Services and your target Web Application for this to work properly!

share|improve this answer
To be a tad more precise: web.config of your web application, web.config of your central administration site and web.config of your STS service. I also assume you're using claims based authentication? Please add your connectionstring config as well, I notice your config says "ADTeste" as name, which seems weird. – Jasper Sep 25 '12 at 14:20
I'm using moss 2007. I forgot to add the connection strings on my SSP. Tried to add it on ssp wb.config, but still not working. The connection strings: <connectionStrings> <add name="ADService" connectionString="LDAP://,DC=org,DC=br" /> <add name="ADTESTE" connectionString="LDAP://,DC=org,DC=br" /> </connectionStrings> – Pablo Bertrão Sep 25 '12 at 14:35 should have mentioned that as equation changes, but still you need to keep your web.config on CA and Web-App at least! – Marius Constantinescu - MVP Sep 25 '12 at 15:05
I did it, still not working. I can log on in my site with a user from Domain2, but it has no permission, since i'm unable give permissions using peoplepicker. – Pablo Bertrão Sep 25 '12 at 16:30
Make sure the case of your connection string name is the same. ADTESTE != ADTeste – RJ Cuthbertson Sep 25 '12 at 17:58

For LDAP providers, the search character is "*", not "%". Is there a reason you're not using Microsoft.Office.Server.Security.LdapMembershipProvider? Here is the way the web.configs are supposed to be configured:

share|improve this answer
I've followed this post to configure my FBA. I will change the web.config as you mentioned and check for differences. – Pablo Bertrão Sep 25 '12 at 18:42
I changed the web.config file using the site you mentioned. I still have the same problem, peoplepicker can find users from domain1 but not domain2. Also, my custom login page cannot authenticate more the users from both domains. Dont i have to inform web.config the connection string user and password for domain? – Pablo Bertrão Sep 26 '12 at 13:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.