3

I have a brand new SharePoint 2016 farm using MinRole configuration.

  • Web Front End Server
  • App Server
  • Distributed Cache Host Server
  • SQL Server

Under web application Authentication Providers, we have "Trusted Identity Provider" selected as the claims authentication type (PortalGuard is the provider).

SharePoint is working as expected, however the People Picker will not return users.

I have following all instructions here:

https://technet.microsoft.com/en-us/library/gg602075.aspx

here:

https://blog.wbaer.net/2009/01/21/people-picker-portprotocol-requirements/

here:

https://thesharepointfarm.com/2014/01/powershell-for-people-picker-properties/

and here:

https://thesharepointfarm.com/2014/01/people-picker-troubleshooting-tips/

I ran this (which is awesome...thank you Trevor Seward):

https://github.com/Nauplius/PeoplePickerPortTester

and it returned no errors with the specified LDAP:// path, username, and password (meaning all users were found and all ports were successfully listening).

UPDATE

As recommended by Trevor, I downloaded and installed the solution LDAPCP and users now resolve correctly in the people picker.

Hopefully for those using custom claims providers in their 2016 farm, this post and answer will be useful.

Improve this question

1 Answer 1

Reset to default
4

The People Picker will only return users when it can query the source of truth. Since you've set up a TIP (SAML?), there is nothing to query and all values would be valid.

In order to perform a true query and get back results from the source of truth, you must build a custom claims provider. LDAPCP is one created for SAML auth, but again this is a scenario where the SharePoint farm has access to the Domain Controllers via LDAP.

Improve this answer
5
  • I guess I'm confused...you say since there's nothing to query and all values would be valid, wouldn't the picker still return something?
    – psdpainter
    Commented Feb 5, 2018 at 21:23
  • You should be able to type in 'abcd', hit check name, and have it underlined. Is that not what you're seeing?
    – user6024
    Commented Feb 5, 2018 at 21:30
  • No it's not...typing any name always returns "No results found". In CA I see all users when attempting to add to, say, User Policy or Farm Administrators group, but from the client no users are returned. Any ideas?
    – psdpainter
    Commented Feb 5, 2018 at 21:35
  • 1
    In this case, it sounds like you have an issue with your TIP. You'll need to go to the ULS logs when you attempt to resolve a user and update your original post.
    – user6024
    Commented Feb 5, 2018 at 21:42
  • It is in fact most likely a TIP issue. Digging through the ULS logs returned an issue with the DirectorySearcher and the TIP. I'll update this post when I have a resolution. Maybe it will help someone else. Thanks, Trevor.
    – psdpainter
    Commented Feb 5, 2018 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.