1

Scenario

We have two synchronisation connections. One uses windows synchronisation and syncs an "Internal" OU group. The other uses forms authentication and syncs an "External" OU Group. This populates all the users that will access the system.

Problem

What I would like to do is stop people logging in if they don't already have a profile. E.g. They are not synced.

Why

Take a average user, Bob. Bob is an external user and therefore we want him to use forms authentication for all scenarios. If Bob tries using windows authentication it will create a new profile which now isn't linked to any information within sharepoint. How can we stop Bob logging in using windows if he is in the external OU.

Addition Info

When we set up the forms authentication, within the provider set up, we have specified the external OU. Therefore anyone in the Internal OU actually can't log in using forms thus solving half our issue.

Ideas

Managing the user policy permissions can stop people logging in which is where I started my investigation. Ideally I would like to deny permission to "all non-synced users" within the user policy for my web application. If this is possible, how can I access that group?

0

You have to implement security. User Profiles are not security. You can do this by granting access to your users by adding them to a group of "Approved Users" in the same way you added them to the OU for synchronization.

  • Ideally we don't want to have to manage it. However if a user does log in, they can request access. How can this be avoided as this creates a User Profile for this account? – Heberda Jul 4 '14 at 13:12
  • You have to manage security. Period. Otherwise the user profile will be created. You could go through and delete the offending profiles, but it is FAR better to take ownership of security and manage it. You are already doing that for the OU, right? Just add a step that adds the users to a Security Group. – Matthew McDermott Jul 4 '14 at 16:14
  • We were attempting to manage it through the OU. If we added all users in the Internal OU to an Internal Security group could we then block forms access? – Heberda Jul 16 '14 at 10:08
  • Yes, the OU is not the same as the security group. You need the group to restrict access. – Matthew McDermott Jul 16 '14 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.