1

So if you have multiple authentication methods, and people connect via those sources, they will have a profile for each authentication method. There absolutely has to be multiple authentication sources for this SharePoint instance, and people must be able to connect via each.

My question is, has anyone successfully mapped two authentication sources to one profile? If so, how?

If this is truly not possible, would you mind explaining why?

Improve this question

1 Answer 1

Reset to default
3

You most only have a single profile for any one individual. SharePoint sees the identity as two different users, and they cannot be 'merged' together.

If you are unable to switch to a single provider for all Web Applications/users, you may want to look at one UPA Service Application per Web Application.

To give you an example, you may have a user come through Active Directory (Windows auth) and the same user come via SAML (e.g. ADFS). With the Windows auth user, SharePoint is able to store the SID of the object (SystemUserKey) and use that as the identifier along with their sAMAccountName. For ADFS, the user is only seen via the attribute used for authentication, e.g. 'mail'. They are two different users as far as an authorization system is concerned.

Improve this answer
8
  • If a user has multiple profiles depending on whether the user logged in via AD or ADFS, it seems to defeat the purpose of SSO. Why is this a problem for Microsoft systems?
    – James Grizzle
    Commented Feb 1, 2016 at 19:30
  • 1
    Why are you using ADFS and Windows Auth? Just use ADFS (and perhaps WAP + ADFS if you need FBA style logins). SSO is provided by a service, such as ADFS, that allows you to log into multiple systems. IE provides "SSO" by simply passing your Windows user/pass to a system that requests it, given it is in the Intranet Zone. It isn't true SSO.
    – user6024
    Commented Feb 1, 2016 at 19:31
  • 1
    WAP + ADFS 3.0 will present a forms-based login scenario. You can also configure ADFS to use a non-claims aware relaying party trust so you do not have to configure SharePoint to use SAML.
    – user6024
    Commented Feb 1, 2016 at 21:14
  • 1
    No, SharePoint is configured to use Windows Auth, but users are pointed at WAP in order to access SharePoint. Great how-to on this: brightstarr.com/sharepoint-technology-and-application-insights/…
    – user6024
    Commented Feb 1, 2016 at 22:58
  • 1
    They're always logging in with Windows Auth, whether it is via WAP or directly to SharePoint. But you point the A record for your Web App at WAP so your users are directed to it.
    – user6024
    Commented Feb 2, 2016 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.