Trying to switch from an ADFS Trusted Identity Provider to Kerberos. In the user profile service, users appear to be different identities. Do I need to migrate every account using Move-SPUser? It seems like most other migrations go from Kerberos to a trusted identity provider not the other way around
-
Are you going ntlm with kerberos from ADFS?– Waqas Sarwar MVP ♦Commented Nov 13, 2016 at 17:02
-
that is correct– MattCCommented Nov 13, 2016 at 17:26
-
Then yes you have to run the move spuser, check my reply– Waqas Sarwar MVP ♦Commented Nov 13, 2016 at 17:38
Add a comment
|
3 Answers
In this case, yes you have to migrate all users from ADFS to windows claims. As sharepoint treat both as a separate ids.
You can also witness after switching the authentication, your user will get access denied. Now you have to run the move spuser to move them.
answered Nov 13, 2016 at 17:35
Convert-SPWebApplication -Identity "http://XXX:8001/" -To Claims -RetainPermissions
I use the above command to convert website XXX on port 8001 to Claims mode.
A good Microsoft reference is: https://blogs.msdn.microsoft.com/besidethepoint/2010/05/08/double-hop-authentication-why-ntlm-fails-and-kerberos-works/
-
This answer is actually incorrect. They're asking about switching from Kerberos (which is probably using Windows Claims) to SAML. SAML conversion requires different switches as outlined in Migration of Windows claims authentication to SAML-based claims authentication in SharePoint Server 2013. Here is a potentially useful additional KB: The Convert-SPWebApplication command cannot convert from Windows claims to SAML in SharePoint Server 2013– user6024Commented Nov 13, 2016 at 21:13
Migrating from SAML to Windows Claims requires some slightly different steps. Microsoft has outlined it here: Migration of Windows claims authentication to SAML-based claims authentication in SharePoint Server 2013. Note that this article includes both processes (Windows -> SAML; SAML -> Windows).
You may also find this KB useful if you run into any issues with the conversion. The Convert-SPWebApplication command cannot convert from Windows claims to SAML in SharePoint Server 2013.