SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web application set up with two extended zones (Default/Internet and Intranet). The default zone uses claims authentication (for external users) and the intranet zone uses windows auth.

When calling the CreateSite endpoint:

adminClient.CreateSite("","Test 1",
    string.Format("Test Site", "Test 1"),

I receive "User cannot be found". If I remove the intranet zone of the web app and make the exact same call the site creates with no issue. My guess is that there's a collision occurring between the user returned from claims and the user returned from windows auth and it doesn't know which to choose so it throws a (poorly worded) exception of "User cannot be found".

I understand I can qualify the username by doing:

"i:0e.t|saml provider|"

One thing I'm not sure of is whether the claims token specifier (0e.t) is always the same?

Also slightly related... Is it possible to have a user be able to authenticate from both zones without having to add both the windows and the claims account? This would probably answer the above question

share|improve this question
Did you ever found a solution for this? You could answer your own question if you found one! – Max Melcher Dec 5 '13 at 16:23
We ended up abandoning dual zone authentication as it is very rare for our users to access sharepoint via windows auth. Our typical use case is through CRM which they log in via ADFS (claims) – Paulo Cristini Dec 5 '13 at 17:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.