I have a number of different software packages where I require a SSO experience. I've rolled out ADFS between all these applications and SharePoint 2013 and it is working well.

I am now facing an issue with the People Picker since my deployment is a multi tenant one, and even if I create a custom claims provider for the People Picker there is no easy way to filter users by tenant. I have seen a forum post on the LDAPCP solution website asking for this very feature however it seems impossible due to restrictions in the SharePoint code.

What I would like to do, is to see if using Forms Based Authentication solves this issue and will help me partition my tenants properly, whilst still having proper People Picker functionality.

Currently in the user profile service, accounts are being stored as: i:05.t|adfs|username@domain.com
My goal is to get users under FBA such as: i:0#.f|membership|username@domain.com
since I believe it will help solve my underlying issue.

The problem is, using FBA will then break my SSO experience with ADFS (I think this is the case anyway).

Is it possible to either:

  1. Have users authenticated via SAML/ADFS to be assigned a forms based claim in SharePoint.
  2. Keep ADFS as a front end to Forms Based Authentication and somehow pass a cookie to FBA to sign in to SharePoint.

    • I've noticed that I may be able to potentially call a URL such as: /_forms/default.aspx?wa=wsignin1.0 from my ADFS service (and pass cookies) but I have no idea how I can achieve this.
  3. Have some kind of script to merge SAML claims to Forms claims for everyone's user profiles, as soon as users get a new profile provisioned.

And finally; I hope that FBA will actually fix my core issue here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.