Hot answers tagged authentication
6
In IE (version > 6) SignOut.aspx uses ClearAuthenticationCache as a client side command. This does not work for Firefox.
I found this example on StackOverflow that might work for you
http://stackoverflow.com/questions/31326/is-there-a-browser-equivalent-to-ies-clearauthenticationcache
6
The key for this question is how do you configure Forms Based Authentication?. In order to make FBA work, you need to add the membership provider and the role manager to the web applications web.config on each front end server in the SharePoint farm.
So why are the other answers incorrect?
Claims based authentication could be from any other source, but it ...
4
A couple of things to check for
First of all - you do not need delegation yet. Wait with that until you get the log on process to work
make sure that the DNS name sharepoint is registered with an A record in DNS (and not a CNAME)
register SPN's for both HTTP/sharepoint and HTTP/sharepoint.bkf.internal
make sure that the account you use when setting the SPN ...
4
You may extend the SharePoint Web application with FBA, to create an extranet-facing access point to provide access to the partners. Extending an existing SharePoint Web application provides a separate IIS Web site and you can group external users into a different security domain than internal users.
This approach makes it easier to manage different ...
3
After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this.
Here's the idea (point by point):
1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN
2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...
3
@James Love got this on the head, you need to take a look at the cookies
Check out this project "Remote authentication with claims" I believe the answer is here in the code.
It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.
3
As the iPad is not a domain device, it doesn't have the capability for cached credentials. The most robust solution I've seen on an iPad uses TMG to handle the authentication component. When the user hits the SharePoint site, they're prompted by TMG for user credentials. TMG then securely processes the authentication and provides the handoff to SharePoint. ...
3
Check out the DelegConfig utility on the IIS site. Deploy this to its own IIS web site, and configure it similar to SharePoint. It will provide troubleshooting steps to verify your SPNs, etc., and see if you are getting a successful Kerberos ticket.
DelegConfig v2 beta (Delegation / Kerberos Configuration Tool)
...
2
Looks to me like there are some rogue configurations in your web.config. Did you ever set a custom membership/role provider manually or in IIS? Did you ever use FBA?
The error message you're getting looks like there is a custom membership provider set which uses a non-existing (or no longer existing) connectionstring for a local SQL server instance. So when ...
2
If your current Authentication Type is Windows then you see the outdated section with
Windows
Forms
Web single sign on
But isn't allowed to change it as the only real options are:
Windows
Claims
If your current Authentication Type is Claims then the section isn't shown.
My guess regarding the reason behind this is:
It was planned to give you ...
2
As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being ...
2
If you can use GPO you can push policy to all computers for mysite to be in intranet zone. Alternatively, you should be able to access mysite without a FQDN.
If neither are acceptable, one trick is to set a startup script to add the AuthForwardServerList reg item to the users computer and add the FQDN to the reg key. Here is link to KB article, also works ...
2
The prefix is a claims identity prefix:
i:0#w| =>
i = identity
# = user login name
w = Windows
so this is a Windows Authentication Claims Identity, which is correct as long as you have configured Claims Authentication on the site.
Call SPWeb.EnsureUser() after you create the user object to add the user to the hidden User Information List for the ...
2
Enable FireFox Kerberos Trust
Open FireFox
In the Location bar, type about:config, and press enter. The about:config "This might void your warranty!" warning page may appear. Click I'll be careful, I promise!, to continue to the about:config page.
In the about:config page, search for the preference network.negotiate-auth.trusted-uris, and double-click ...
2
In case this helps anyone else (or me in the future) you can do this with:
$winAp = new-SPAuthenticationProvider -UseWindowsIntegratedAuthentication
$stsAp = Get-SPTrustedIdentityTokenIssuer "YourSTS"
Set-SPWebApplication -Identity $webApp -AuthenticationProvider $stsAp, $winAp -Zone "Default"
2
If you are looking for more security, Basic Authentication is not something you should consider.When using Basic authentication,User name and password are transmitted between the client and server as clear text. So its not secure at all unless you use SSL.
In NTLM, the password is never transmitted across the wire and hence it is much more secure then Basic ...
1
I have a SharePoint 2010 site that has Kerberos auth properly configured and is added to my "Trusted Sites" in Internet Options.
Using KerbTray I get a Kerberos ticket on both Chrome and FireFox. I purged tickets before each attempt.
I then opened SQL Server Management Studio and connected to the SharePoint DB server. I opened a new query window and used ...
1
OpenID Membership Provider is an ASP.Net Membership provider and login
control that is compatible with the OpenID Authentication 2.0
implementation.
It allows you to quickly upgrade your ASP.Net 2.0 or SharePoint site
to take full advantage of OpenID.
The OpenID Membership Provider can be used side by side with another
ASP.Net Membersip ...
1
Well I would point the customer towards the share functionality in SharePoint Online. But if you want to do this custom then yes it is very possible.
Take a look at Windows Live ID authentication for SharePoint 2010 on codeplex, this would become the basis of what would be a custom page in SharePoint to server the requested file.
1
By default you will be authenticated as the current user logged in (assuming your on the server, you're probably one of the farm administrator).
You can impersonate to anyone else using this kind of code
//get this current user's user token
SPUserToken userToken = web.AllUsers[*user*].UserToken;
//create an SPSite object in the context of this user
using ...
1
$authprov = Get-SPAuthenticationProvider -WebApplication [web application URL] -Zone [zone]
# Check the AllowAnonymous property:
$authprov.AllowAnonymous
Should return true or false
http://myspworld.wordpress.com/2012/05/31/anonymous-claims-authentication/
1
By "want DomainB to work" I assume you mean that you want users that are members of Domain B to be able to log into SharePoint. To allow this I believe you just need to have Domain A trust Domain B. This assumes you are using NTLM or Kerberos accounts and not a Trusted Identities.
You would also, of course, need to make sure that you gave access to the ...
1
I faced a similar problem very recently, and my solution was as follows:
Retrieve the credentials from the Secure Store, as described on MSDN.
Use this codeproject page as a guide to build an Impersonate User class.
Surround the calls made to the database with Impersonation of the user from the Secure Store.
I then created a base class for my BDC Service ...
1
Out of the box no. You would need to create custom code or script that runs thru and captures your LDAP user permissions than assign those to the windows user.
Third party administrative products like Axceler ControlPoint and AvePoint DocAve, have this ability. While they are great tools, it's not very cost effective to deploy them for this single ...
1
Working against a claims based SharePoint site unfortunately isn't simple. The best resource is probably the blog Share-n-dipity the article Using the Client Object Model with a Claims Based Auth Site in SharePoint 2010 has code for a Windows Forms app which might be a good starting point.
1
Problem solved:
Checked my Quick Launch and the links on /FR were with http://www.foo.org and on /EN they were without the 'www', just like: http://foo.org
Thanks for helping me out though!
1
If the Java Client is running on a different server than the Sharepoint Webservice (and I think this is probably the case) and the AD account, under which your client process runs, is different from the account you use to authenticate with on the webservice, then I think you have a double-hop issue, due to the fact that you are trying to use NTLM.
NTLM is ...
1
When you say that it logs you in as admin instead - are you saying you should be allowed access anonymously or authenticated but just a lower priv account?
I recently had an issue where we got challenged at root but okay if we went in direct at a lower level URL. Turned out I needed to switch anonymous access at the site collection AND web app level on then ...
1
I think you need to read what Microsoft has discussed in glorious detail about all Authentication Mechanisms supported by SharePoint 2010:-
http://technet.microsoft.com/en-us/library/cc262350.aspx
Additionally, if you are planning for creating a topology with various authentication mechanism follow this deployment reference :-
...
1
Did you change anything recently ?
Any Master page updated but not published / approved ?
Any Page layout updated but not published / approved ?
Is it occuring on all pages or only on some page ? Did you add a web / user control recently that could require more permissions than what is available for the anonymous user ?
Do you still have your binding ...
Only top voted, non community-wiki answers of a minimum length are eligible
