So according to TechNet (http://technet.microsoft.com/en-us/library/gg602078(v=office.15).aspx)

By default, when you use SAML token-based authentication, all queries entered in the text box are automatically displayed as if they were resolved, regardless of whether they are valid users or groups.

Is there any way to disable or turn off that functionality so that only the results from my custom SPClaimProvider are show (i.e. from FillResolve and FillSearch calls)?

I've been able to turn off results from Active Directory (when NTLM auth is turned on). But haven't seen any documentation or ways to get rid of the automatic resolution for claims that are mapped from the identity provider. Thanks.

1 Answer 1


I found this article http://blogs.msdn.com/b/kaevans/archive/2013/05/26/fixing-people-picker-for-saml-claims-users-using-ldap.aspx. Near the very bottom it says you need to register the custom code as the claim provider for the token issuer. Now only the entries that have been resolved in custom code show up as resolvable.

The last step is to register your claim provider as the default for the SPTrustedIdentityTokenIssuer.

$ap = Get-SPTrustedIdentityTokenIssuer "ADFS SAML Provider"
$ap.ClaimProviderName = "LDAPClaimProvider"

This step is necessary because it will allow us to override the claims issued by this provider, otherwise we would issue duplicate claims and get some weird errors in SharePoint about users not being unique.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.