Windows Claims / Forms Claims - Augmentation - How to

Question

Can claims augmentation be used to "map" a Windows Claim to a Forms Claim?

Scenario:

• WebApp1: Forms Claims Auth (LDAP Provider)
• WebApp2: Windows Claims Auth

With Claims Augmentation, can I make it to where a user from WebApp2 with a Windows Claim is allowed into WebApp1 without additional login - or vice versa Forms Claims augmented to allow Authentication to the Windows Claim web app?

Any input would be great

Answer 1

At first glance I think this might be possible (using a custom Claim Provider and implementing FillClaimsForEntity), however I'm not sure how or if it's possible to create a secondary identity claim, and fool SharePoint into thinking it's a genuine identity claim from whichever identity provider. Also - I don't know if SharePoint can even handle multiple identity claims in an identity.

Your next problem, if it is possible, is how you plan to map between FBA and Windows accounts, are you going to keep a mapping table somewhere? Your claim provider will need to look up this mapping table and create the appropriate second identity claim.

If SharePoint can't handle multiple identity claims, you could probably authorise users using a custom claim provider (ie: entries from your claim provider are used from the People Picker and granted access to the Site Groups), and your claim provider's FillResolve methods could perhaps resolve the appropriate claim (via the aforementioned) mapping table depending on the incoming claim.