Bit of a strange issue here, which I just can't seem to solve. I'll start by explaining the environment:
Environment
SharePoint 2010 Enterprise, Build Number 14.0.7113.5000
Windows Server 2008 R2
IIS 7.5
Web Application Authentication Specifics
Web application has 3 zones for different Authentication Methods:
Default Zone - Custom Trusted Identity Provider (ADFS)
Intranet Zone - NTLM
Extranet Zone - FBA
Mysite Location
Managed Path : /mysite/
Issue
A strange situation has been found where users who Authenticate via the ADFS Custom Identity Provider (i.e. all users of the site) cannot access any links to do with adding a colleague (aka "QuickLinksDialogForm.aspx"). This includes the following links :
Add Colleagues (This link throws an "Unauthorised" message)
View Suggestions (This link throws an "Unauthorised" message)
Edit Colleagues (This link does nothing)
Remove Colleagues (This link does nothing)
If a user who gets authenticated via NTLM (i.e. the back end hosting team), these links work fine.
Side note : FBA Users cannot access /mysite/ at all. This is fine.
About the error message
Screenshot : The unauthorised error message.
This error message is actually an in-screen pop-up. It is displayed whenever "QuickLinksDialogForm.aspx" is called by an ADFS user.
This is unfortunate, as "QuickLinksDialogForm.aspx" is actually located within the SharePoint 14 hive in the LAYOUTS folder :
"C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\TEMPLATE\LAYOUTS\QuickLinksDialogForm.aspx"
Screenshot : The Quicklinks .aspx files within the LAYOUTS folder in the 14 hive.
If an NTLM user accesses this link, the correct content is displayed:
Screenshot : Correctly loading content.
I have tried to find the reason for this issue, and have so far been unable to figure it out. SharePoint is complaining about permissions, however the same issue occurs even when a user is given Full Control, Site Collection Administrator, and even Full Control Policy on the Web Application. It makes no difference.
I have looked at this issue from multiple angles, from permissions, to encoding, and to claims. My best guess is that there is some issue with claims, although I have not being able to capture any proof in ULS, F12 Dev Tools or Fiddler. The only thing I have not done is wiresharked the packets to see what is happening behind the scenes.
I do not have visibility over the ADFS side of things, however I have a contact over there who could possibly have access to answer any specific questions that may arise.
Has anyone seen this behaviour before?
Kind Regards
