Hot answers tagged

5

You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users. This approach makes it easier to manage different ...


5

This may not be the exact answer you are looking for, but it may simplify your process. With Windows Server 2012 R2 you can use the new Web Application Proxy. It is basically a proxy for your ADFS and SharePoint servers (which is useful when exposing outside the network). You can setup SharePoint with normal NTLM or Kerberos authentication. When clients ...


4

The solution: the clock was wrong. After a great deal of debugging using what @Nikhil provided as a guide, I eventually found the root cause of my expiring token issue: the clock on the SharePoint server was exactly one hour ahead of the clock on the ADFS server. The time zones were set wrong as well, so visually the clocks looked right, but the UTC time ...


4

I've come across this error before, it was because the ADFS server was not configured correctly. When configuring the relying party in ADFS - for SharePoint - you have to add "/_trust" to the "WS-Federation Passive protocol URL" field. See step 11 in this guide. Steve Peschka also mentions it on his blog: ...


4

After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this. Here's the idea (point by point): 1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN 2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...


3

you should be understanding the concept of Authentication Providers in Sharepoint which makes use of claims based authentication. For your requirement you need to implement SSO for your application which would be done by STS in Sharepoint 2010.You need to implement and get the SAML2.0 token from Identity provider(that is the 3rd party network) and convert to ...


3

There is no way to change the claimprovider back to the original one. You'll have to remove the SPTrustedIdentityTokenIssuer and create it again with the right settings. Be sure to use the same name if you want your existing users to be able to login again. Remove your SPTrustedIdentityTokenIssuer from all web applications Delete your ...


3

@James Love got this on the head, you need to take a look at the cookies Check out this project "Remote authentication with claims" I believe the answer is here in the code. It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.


3

Multiple endpoints in the same relying trust is possible if the SPTrustedIdentityTokenIssuer has UseWReplyParameter enabled. This should help out with SharePoint Hosted and Provider Hosted apps. $tit = Get-SPTrustedIdentityTokenIssuer fs.contoso.com $tit.UseWReplyParameter = $true $tit.Update() Please see the following blog: SharePoint and ADFS with ...


2

You have to configure the Seprate end point for each Web application. $ap1 = Get-SPTrustedIdentityTokenIssuer -identity "Adfs name" $uri = new-object System.Uri("url of webapp/") $ap1.ProviderRealms.Add($uri, "urn:sharepoint:MySite") $ap1.Update()


2

Answering your first question - The "Expiration of the session" depends on SAML TokenLifetime and LogonTokenCacheExpirationWindow values. It doesn't depend on the cookie value. The cookie value is just a reference to the actual SAML Token. It is not an indicator of session validity. Regarding your second question, you may not want to increase the ADFS ...


2

Robert Lindgren should get credit for answering this questions because he is correct. ADFS is set at the web app level and can't be targeted at a specific site collection (or site) within it. I verified this with a Microsoft support engineer during a support call for a related matter.


2

There are several "gotchas" with Move-SPUser, particularly when it comes to system accounts (object cache, search crawler, etc.). For user accounts, it is a fairly straightforward process. The big thing to nail down is "How is the user name changing?" in the associated claim from your STS (e.g. I was CONTOSO\Scott in the past, but now in AD FS my identifier ...


2

LogonTokenCacheExpirationWindow :Check the event viewer of ADFS and check if there is any exception like mentioned below. Microsoft.IdentityServer.Web.InvalidRequestException: MSIS7042: The same client browser session has made '6' requests in the last '11' seconds. Contact your administrator for details. at ...


2

When you configure saml on SP there is no people picker. This is because SP does not know where the users are. ADFS is not a user store it is a security token service that issues a tokens when a user is authenticated. Nothing else. You could implement your own claims provider that speaks with AD. There are some articles on the net: ...


2

So you're saying you've got name.net as well as name.com as SANs within your certificate? For your canonical names you need *.name.net as a subject alternative name if you wish to use an unlimited number of canonical names. ADFS fully supports wildcard certificates if you create them with valid subject alternative names.


2

how about following msdn? try using ClaimClientContext.GetAuthenticatedContext instead string targetSite = "http://SharePointServer/"; using (ClientContext CNX = ClaimClientContext.GetAuthenticatedContext(targetSite)) { //Load Libraries from SharePoint CNX.Load(CNX.Web.Lists); CNX.ExecuteQuery(); using ...


2

The solution described here is for SP 2010 but works perfectly fine against SP2013. Summary: You cannot use SharePointOnlineCredentials class. You need to get the FedAuth cookie by making a request against the ADFS server and then attach it to every CSOM request. Update Here are some sample values for all those parameters: wctx = ...


2

Wictor Wilén recently wrote a post on using Azure Access Control Services to do this. The post is at http://www.wictorwilen.se/Post/Visual-guide-to-Azure-Access-Controls-Services-authentication-with-SharePoint-2010-part-1.aspx This is not using ADFS, but it shows access using both Google and Windows Live ID.


2

Your code needs to create the claim, and you specify the original issuer in the constructor. Steve wrote about this too. http://blogs.technet.com/b/speschka/archive/2010/05/25/replacing-the-out-of-box-name-resolution-in-sharepoint-2010-part-2.aspx The claim provider does not know about the login provider (token issuer). Since you will already have the login ...


2

for that scenario you have two options: First option: SharePoint trusting LiveID and ADFS Second option: SharePoint trusting Windows Azure Access Control Service (ACS) and ACS trusting LiveID or ADFS. First option Configure claims-based authentication using Windows Live ID (SharePoint Server 2010) Configure authentication using a SAML security token ...


1

Working against a claims based SharePoint site unfortunately isn't simple. The best resource is probably the blog Share-n-dipity the article Using the Client Object Model with a Claims Based Auth Site in SharePoint 2010 has code for a Windows Forms app which might be a good starting point.


1

I would say your user profile service is not working for some reason or another, I would check the logs and look for more details. Is this a console application? I am not sure where you are using your code remember SPContext doesn't exist here. Is sql server fully up to date with the latest service pack? This causes errors with user lookups and direct ...


1

Danny Jessee has a blog post that shows how he integrated LinkedIn as an authentication source without using ACS. Reviewing how he did that might be useful for you. It builds on the Travis Neilsen blog article mentioned above. http://www.dannyjessee.com/blog/index.php/2012/02/using-linkedin-as-an-identity-provider-for-sharepoint-2010/


1

Update User Profiles via a BCS connection to the web service. The built-in timer jobs will then update the user information list.


1

Please take a look at this thread: Mounted Office 365 sharepoint workspaces lose connectivity - how to fix? I proposed an answer using PowerShell but the original poster has not had a chance to implement it. Basically it is a PowerShell script that logs into the site and then accesses a web page. Please let me know if this works I am very curious about ...


1

Did you configure SharePoint as the relying party in the "ADFS Account provider"? The "-realm" parameter of the SharePoint New-SPTrustedIdentityTokenIssuer cmdlet should be the identifier of SharePoint in ADFS. That is how ADFS knows who is requesting the token. Nothing from your resource ADFS should be configured in SharePoint. It only talks with the ...


1

Apparently Outlook tries to authenticate in the first zone he can find. An the order of the first zones is: Intranet Default ... So essentially we change the ADFS zone to the intranet zone and it worked.


1

Here is one more article explaining sharepoint 2013 security model http://sureshpydi.blogspot.in/2013/03/sharepoint-2013-security-model.html



Only top voted, non community-wiki answers of a minimum length are eligible