Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have configured my SharePoint 2010 as it says on Configuring SharePoint 2010 and ADFS v2 End to End and authentication works. However, on my people picker "SAML Provider" is not shown. Also I can not search for any user and/or AD groups, and I can not add it inside web application / site collection. Environment is: ADFS 2.0, Windows Server 2008 R2, SharePoint 2010 with SP1., ADFS is using only local AD domain.

I have created "SAML Provider" for use with AD FS 2.0

$map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming
New-SPTrustedIdentityTokenIssuer -Name "SAML Provider" -Description "SharePoint secured by SAML" -realm "urn:seo:sharepoint" -ClaimsMappings $map1,$map2 -SignInUrl "https://adfs.mycompany.com/adfs/ls" -IdentifierClaim $map1.InputClaimType -ImportTrustCertificate (Get-PfxCertificate \\MYFileServer\share\ADFS-SP.cer)

Create Web Application with authentication provider

New-SPWebApplication -Name "My Lab2010 Site" -Port 443 -HostHeader sp.mycompany.com -URL "https://sp.mycompany.com" -ApplicationPool "MyLab2010SiteAppPool" -ApplicationPoolAccount (Get-SPManagedAccount "sp-siteapppool") -SecureSocketsLayer -DatabaseName "MyLab2010Site" -DatabaseServer "mysqlsrv\sp" –AuthenticationProvider (Get-SPTrustedIdentityTokenIssuer -Identity "SAML Provider")

Create new site collection from Team Site english template:

New-SPSite -Name "My Lab2010 Site" -URL "https://sp.mycompany.com" -OwnerAlias "administrator@mycompany.com" -Language 1033 -Template "STS#0" -SecondaryOwnerAlias "anotheradmin@mycompany.com"

Here I do have only System, Active Directory, All Users and Forms auth

Get-SPClaimProvider

I have noticed that I am missing something ?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

When you configure saml on SP there is no people picker. This is because SP does not know where the users are. ADFS is not a user store it is a security token service that issues a tokens when a user is authenticated. Nothing else.

You could implement your own claims provider that speaks with AD. There are some articles on the net:

Another alternative would be using something lime Auth0 (full disclosure: I work there)

http://blog.auth0.com/2013/05/04/A-much-better-People-Picker-for-SharePoint/

share|improve this answer
    
Ok, thank you. So, without people picker, how can I use Active Directory Groups in my scenario ? how can I assign permissions to them for example ? –  hkusulja Jun 26 '13 at 15:11
    
You would have to send the groups on the SAML token (creating a rule on ADFS), use PowerShell on SharePoint to make sure those claims are passed through and then on the people picker you would have to type those group names by hand (there is no look up against AD). –  woloski Jun 27 '13 at 2:15
    
I think I have done this by tutorial (link in my first question) - enabled groups for auth. If this is not what you mean please be more specific and any additional link for configuring this would be highly appreciated. So without people picker and ClaimsProvider, how can I add permissions to another user and/or group from my AD FS. Simple does not accept my input, but default site collection admins are added and works normally. Thank you –  hkusulja Jun 27 '13 at 9:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.