Hot answers tagged

5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

This may not be the exact answer you are looking for, but it may simplify your process. With Windows Server 2012 R2 you can use the new Web Application Proxy. It is basically a proxy for your ADFS and SharePoint servers (which is useful when exposing outside the network). You can setup SharePoint with normal NTLM or Kerberos authentication. When clients ...


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


4

I've come across this error before, it was because the ADFS server was not configured correctly. When configuring the relying party in ADFS - for SharePoint - you have to add "/_trust" to the "WS-Federation Passive protocol URL" field. See step 11 in this guide. Steve Peschka also mentions it on his blog: ...


3

you should be understanding the concept of Authentication Providers in Sharepoint which makes use of claims based authentication. For your requirement you need to implement SSO for your application which would be done by STS in Sharepoint 2010.You need to implement and get the SAML2.0 token from Identity provider(that is the 3rd party network) and convert to ...


3

There is no way to change the claimprovider back to the original one. You'll have to remove the SPTrustedIdentityTokenIssuer and create it again with the right settings. Be sure to use the same name if you want your existing users to be able to login again. Remove your SPTrustedIdentityTokenIssuer from all web applications Delete your ...


3

@James Love got this on the head, you need to take a look at the cookies Check out this project "Remote authentication with claims" I believe the answer is here in the code. It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.


2

Robert Lindgren should get credit for answering this questions because he is correct. ADFS is set at the web app level and can't be targeted at a specific site collection (or site) within it. I verified this with a Microsoft support engineer during a support call for a related matter.


2

There are several "gotchas" with Move-SPUser, particularly when it comes to system accounts (object cache, search crawler, etc.). For user accounts, it is a fairly straightforward process. The big thing to nail down is "How is the user name changing?" in the associated claim from your STS (e.g. I was CONTOSO\Scott in the past, but now in AD FS my identifier ...


2

Wictor Wilén recently wrote a post on using Azure Access Control Services to do this. The post is at http://www.wictorwilen.se/Post/Visual-guide-to-Azure-Access-Controls-Services-authentication-with-SharePoint-2010-part-1.aspx This is not using ADFS, but it shows access using both Google and Windows Live ID.


2

Your code needs to create the claim, and you specify the original issuer in the constructor. Steve wrote about this too. http://blogs.technet.com/b/speschka/archive/2010/05/25/replacing-the-out-of-box-name-resolution-in-sharepoint-2010-part-2.aspx The claim provider does not know about the login provider (token issuer). Since you will already have the login ...


2

for that scenario you have two options: First option: SharePoint trusting LiveID and ADFS Second option: SharePoint trusting Windows Azure Access Control Service (ACS) and ACS trusting LiveID or ADFS. First option Configure claims-based authentication using Windows Live ID (SharePoint Server 2010) Configure authentication using a SAML security token ...


2

So you're saying you've got name.net as well as name.com as SANs within your certificate? For your canonical names you need *.name.net as a subject alternative name if you wish to use an unlimited number of canonical names. ADFS fully supports wildcard certificates if you create them with valid subject alternative names.


2

how about following msdn? try using ClaimClientContext.GetAuthenticatedContext instead string targetSite = "http://SharePointServer/"; using (ClientContext CNX = ClaimClientContext.GetAuthenticatedContext(targetSite)) { //Load Libraries from SharePoint CNX.Load(CNX.Web.Lists); CNX.ExecuteQuery(); using ...


2

When you configure saml on SP there is no people picker. This is because SP does not know where the users are. ADFS is not a user store it is a security token service that issues a tokens when a user is authenticated. Nothing else. You could implement your own claims provider that speaks with AD. There are some articles on the net: ...


2

LogonTokenCacheExpirationWindow :Check the event viewer of ADFS and check if there is any exception like mentioned below. Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '11' seconds. Contact your administrator for details. at ...


2

The solution: the clock was wrong. After a great deal of debugging using what @Nikhil provided as a guide, I eventually found the root cause of my expiring token issue: the clock on the SharePoint server was exactly one hour ahead of the clock on the ADFS server. The time zones were set wrong as well, so visually the clocks looked right, but the UTC time ...


2

The solution described here is for SP 2010 but works perfectly fine against SP2013. Summary: You cannot use SharePointOnlineCredentials class. You need to get the FedAuth cookie by making a request against the ADFS server and then attach it to every CSOM request. Update Here are some sample values for all those parameters: wctx = ...


2

Answering your first question - The "Expiration of the session" depends on SAML TokenLifetime and LogonTokenCacheExpirationWindow values. It doesn't depend on the cookie value. The cookie value is just a reference to the actual SAML Token. It is not an indicator of session validity. Regarding your second question, you may not want to increase the ADFS ...


1

You do not need to add the SP servers to domain of external customers AD. You can configure ADFS to use claims between SP and the external customers AD. https://msdn.microsoft.com/en-us/library/hh446526.aspx


1

So, on our domain controller, the time was 10 min. ahead of the actual time. When it was corrected the users were able to enter normally. We are assuming that the time difference was interfering with the encryption/decryption of the SAML token and hence the error says The SAML response has content that is not supported.


1

Did you add in Elements.xml inside CustomAction this? HostWebDialog="TRUE" HostWebDialogWidth="500" HostWebDialogHeight="500" EDIT If you are using Cross Site Publishing try adding <WebPartPages:AllowFraming runat="server"/> inside master page like in this link


1

I'm not sure you can do that with SharePoint. You will have a "claim" from ADFS that will allow you to get into both your web applications. When you sign out of SharePoint, ADFS doesn't know that (unless you modify the sign out form to pass you over to ADFS sign out). So when you access the web app again - you simply pass the token you already have. ...


1

As per the my knowldge, you cant crawl with ADFS authentication. You have to have the windows authentication. SharePoint search only crawl the windows authentication. This is by design. In order for the SharePoint Search to crawl content we need to configure “Windows Authentication” on at least one zone in the Web Application. You can enable the windows ...


1

if there are more than one account with same email address it will cause the issue. if the primary identification claim (email) changes, nothing in SharePoint will match, and the user will be considered completely separate.. all permissions and item tracking (tasks assigned, user profiles, etc) will effectively belong to a different user. ...


1

ADFS: The TokenLifetime property can be set at the ADFS end using the command upon creation . Below is example is for 2 sec . Set this value to a high number ,so that the session never expires while working on page . Add-ADFSRelyingPartyTrust -Name "abc" -Identifier "https://abc/_trust/" -WsFedEndpoint "https://abc/_trust/" -TokenLifetime 2 ...


1

Figured out how to solve this. If you need to set permissions for specific users, you will need to type the exact e-mail address in the people pickers. This user will be marked as invalid when you edit the permissions, but it works. The second option is to add the All Authenticated Users (NT Windows token) claims equivalent of c:0(.s|true to the Members ...


1

try the below code and see if it works $claim = New-SPClaimsPrincipal -TrustedIdentityTokenIssuerr $ap -Identity UserName $site = New-SPSite $url -OwnerAlias $claim.ToEncodedString() -template "STS#0" I think you need to encode the string to get it works. http://technet.microsoft.com/en-us/library/ff607753(v=office.14).aspx#section1 Also check this one: ...


1

namespace SPClient { class FedAuthUtility { public Cookie GetAuthCookie(String Url, String uname, String pswd) { CookieContainer CookieJar = new CookieContainer(); Uri authServiceUri = new Uri(Url+ "/_vti_bin/authentication.asmx"); HttpWebRequest spAuthReq = HttpWebRequest.Create(authServiceUri) as ...


1

It definitely is possible to have item level permissions based on a claim just like you ask. However, please consider the performance impact as this is "Fine Grained Permissions" and is one of the things to avoid if at all possible. Read this excellent Best practices for using fine-grained permissions in SharePoint Server 2013 guide on technet. I recommend ...



Only top voted, non community-wiki answers of a minimum length are eligible