Hot answers tagged

5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

This may not be the exact answer you are looking for, but it may simplify your process. With Windows Server 2012 R2 you can use the new Web Application Proxy. It is basically a proxy for your ADFS and SharePoint servers (which is useful when exposing outside the network). You can setup SharePoint with normal NTLM or Kerberos authentication. When clients ...


5

The solution: the clock was wrong. After a great deal of debugging using what @Nikhil provided as a guide, I eventually found the root cause of my expiring token issue: the clock on the SharePoint server was exactly one hour ahead of the clock on the ADFS server. The time zones were set wrong as well, so visually the clocks looked right, but the UTC time ...


4

I've come across this error before, it was because the ADFS server was not configured correctly. When configuring the relying party in ADFS - for SharePoint - you have to add "/_trust" to the "WS-Federation Passive protocol URL" field. See step 11 in this guide. Steve Peschka also mentions it on his blog: http://blogs.technet.com/b/speschka/archive/2012/05/...


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


3

There is no way to change the claimprovider back to the original one. You'll have to remove the SPTrustedIdentityTokenIssuer and create it again with the right settings. Be sure to use the same name if you want your existing users to be able to login again. Remove your SPTrustedIdentityTokenIssuer from all web applications Delete your ...


3

you should be understanding the concept of Authentication Providers in Sharepoint which makes use of claims based authentication. For your requirement you need to implement SSO for your application which would be done by STS in Sharepoint 2010.You need to implement and get the SAML2.0 token from Identity provider(that is the 3rd party network) and convert to ...


3

@James Love got this on the head, you need to take a look at the cookies Check out this project "Remote authentication with claims" I believe the answer is here in the code. It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.


3

Multiple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted Apps. $tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com $tit.UseWReplyParameter = $true $tit.Update() Please see the following blog: SharePoint and ADFS with SharePoint Hosted apps


2

Your code needs to create the claim, and you specify the original issuer in the constructor. Steve wrote about this too. http://blogs.technet.com/b/speschka/archive/2010/05/25/replacing-the-out-of-box-name-resolution-in-sharepoint-2010-part-2.aspx The claim provider does not know about the login provider (token issuer). Since you will already have the login ...


2

for that scenario you have two options: First option: SharePoint trusting LiveID and ADFS Second option: SharePoint trusting Windows Azure Access Control Service (ACS) and ACS trusting LiveID or ADFS. First option Configure claims-based authentication using Windows Live ID (SharePoint Server 2010) Configure authentication using a SAML security token (...


2

Wictor Wilén recently wrote a post on using Azure Access Control Services to do this. The post is at http://www.wictorwilen.se/Post/Visual-guide-to-Azure-Access-Controls-Services-authentication-with-SharePoint-2010-part-1.aspx This is not using ADFS, but it shows access using both Google and Windows Live ID.


2

how about following msdn? try using ClaimClientContext.GetAuthenticatedContext instead string targetSite = "http://SharePointServer/"; using (ClientContext CNX = ClaimClientContext.GetAuthenticatedContext(targetSite)) { //Load Libraries from SharePoint CNX.Load(CNX.Web.Lists); CNX.ExecuteQuery(); using (...


2

When you configure saml on SP there is no people picker. This is because SP does not know where the users are. ADFS is not a user store it is a security token service that issues a tokens when a user is authenticated. Nothing else. You could implement your own claims provider that speaks with AD. There are some articles on the net: http://blog.podrezo....


2

LogonTokenCacheExpirationWindow :Check the event viewer of ADFS and check if there is any exception like mentioned below. Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '11' seconds. Contact your administrator for details. at Microsoft.IdentityServer.Web....


2

So you're saying you've got name.net as well as name.com as SANs within your certificate? For your canonical names you need *.name.net as a subject alternative name if you wish to use an unlimited number of canonical names. ADFS fully supports wildcard certificates if you create them with valid subject alternative names.


2

You cannot use SharePointOnlineCredentials class. You need to get the FedAuth cookie by making a request against the ADFS server and then attach it to every CSOM request. Update Here are some sample values for all those parameters: wctx = "SITEURL/_layouts/Authenticate.aspx?Source=%2F" wreply = "SITEURL/_trust/" stsUrl = "https://auth.your.adfs.server.com/...


2

Answering your first question - The "Expiration of the session" depends on SAML TokenLifetime and LogonTokenCacheExpirationWindow values. It doesn't depend on the cookie value. The cookie value is just a reference to the actual SAML Token. It is not an indicator of session validity. Regarding your second question, you may not want to increase the ADFS ...


2

Robert Lindgren should get credit for answering this questions because he is correct. ADFS is set at the web app level and can't be targeted at a specific site collection (or site) within it. I verified this with a Microsoft support engineer during a support call for a related matter.


2

There are several "gotchas" with Move-SPUser, particularly when it comes to system accounts (object cache, search crawler, etc.). For user accounts, it is a fairly straightforward process. The big thing to nail down is "How is the user name changing?" in the associated claim from your STS (e.g. I was CONTOSO\Scott in the past, but now in AD FS my identifier ...


1

It definitely is possible to have item level permissions based on a claim just like you ask. However, please consider the performance impact as this is "Fine Grained Permissions" and is one of the things to avoid if at all possible. Read this excellent Best practices for using fine-grained permissions in SharePoint Server 2013 guide on technet. I recommend ...


1

"Error occurred in deployment step 'Install app for SharePoint': The System Account cannot perform this action.>" for this error you need to change your system account Go to Central admin-> Security -> Configure Service account -> select your web application pool in drop-down - > in account drop-down you need change any other instead of current log-in ...


1

A lot of questions there. I would say first off, find a good SharePoint partner firm to assist you with the evaluation and migration. Preferably one with )365 migration experience specifically. Depending on your in house skill set, you may not need them there to perform the tasks, but having someone to lean on for planning, and project issues can be a ...


1

Please make sure that your Build Configuration for your windows application is set to Platform Target: (Any CPU) or Platform Target (x64) in Project Properties --> Build --> General in Visual studio For setting permissions on ClientContext: CNX.Credentials = new NetworkCredential("user", "password", "domain"); or CNX.Credentials = ...


1

Here is one more article explaining sharepoint 2013 security model http://sureshpydi.blogspot.in/2013/03/sharepoint-2013-security-model.html


1

Apparently Outlook tries to authenticate in the first zone he can find. An the order of the first zones is: Intranet Default ... So essentially we change the ADFS zone to the intranet zone and it worked.


1

Yes, it s possible. Set your web application to anonymous access and everything that goes with it. In your sub site, break inheritance, then set up permissions accordingly using groups that are AD only. Someone trying to access the sub-site will be prompted for credentials.


1

Claims Based Identity & Access Control Guide from Microsoft: http://claimsid.codeplex.com/ Includes an appendix on SharePoint. But you should read the entire thing to understand the concepts. It is not a trivial exercise.


1

You will need to understand Claims Authentication and how SAML + ADFS fits into a single authentication umbrella for authenticating users from multiple domains to a single sharepoint 2010 farm. configure AD FS v 2.0 in SharePoint Server 2010 Implementing Claims for SharePoint 2010 Custom Claims provider for people picker



Only top voted, non community-wiki answers of a minimum length are eligible