SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we have a sharepoint farm where we would like to use AD authentication in conjunction with ADFS authentication. The ADFS and AD-Authentication work both (on different AAMs).

What i want to accomplish:

  • Users should be able to log on by ADFS or AD (or ADFS-only as fallback)
  • No duplication of user objects (because of security settings, which can be made by users - the would have to make it twice otherwise)
  • PeoplePicker should work as if user came from AD
  • Functions like "SPUser.Ensure()" should work as expected
  • Sharepoint should display the users name and not token in the upper right corner

I managed to use the AD-PeoplePicker together with the ADFS, but the created tokens are windows internal tokens instead of trusted issuer tokens. Has someone any experience with doing this and can give me some advice how to accomplish my tasks?

share|improve this question
Did you ever figure this out? This is the exact same scenario I'm looking for in 2013. Thanks! – Brian Jan 15 at 20:32
Nah - we still stick to AD with an WAP (WebApplicationProxy), which converts external ADFS to internal Windows Auth. That makes everything work expect anonymous access. – TGlatzer Jan 17 at 15:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.