We configure custom claim provider in our SharePOint 2013 environment. The custom claim provider for people picker behave as what we expected except it except it both pick up from Custom claim provider and AD. I have tried to resolved this by disable Windows Authentication in Authentication Provider. However, if we disable Windows Authentication Provider then this message displayed "If Windows authentication is not selected on any Zone of this Web application, crawling for this Web application will be disabled. "

So there any work around to solve SharePoint 2013 people picker with custom claim provider (Trusted Identity Provider) as well the crawling working with only Trusted Identity Provider enabled.

Thank you

2 Answers 2


In this Scenario you need to tweek your AAM. As you already setup your web site in default zone with ADFS authentication which will cause alot of problem. Crawler requires windows Authnetication in default zone to get maximum performance.

there is an undocumented assumption baked into SharePoint Search that the Default Public URL of a Web Application will be crawled. If you want everything to work auto-magically, crawl the Web Application's Public URL for the Default zone (*Note: the crawler requires Windows Authentication [NTLM or Kerberos] in whatever zone your crawl …meaning your Default zone should include Windows Authentication). Otherwise, when crawling a non-Default zone, expect things to break such as contextual queries like "this site" and "this list" as well as inconsistent URLs returned in query results

In your situation, you create Web Application with windows authentication in default zone. then extend your web application into different zone with ADFS authentication. In this way search will use the default zone for crawling and extended will be used for users.



  • thanks for quick response and suggestion. Extend the web application is not scalable for us. Currently we have 20 web applications. It will end up 40 web applications if we decide to extend the web application
    – Supermode
    Sep 11, 2014 at 2:34
  • yes, this is one or other thing....either extend keep out of AD or you have both...Another thing i am thinking if their is something you can configure the People Picker and remove the Result from AD( some kind of coding)
    – Waqas Sarwar MVP
    Sep 11, 2014 at 2:59

I solved the issue by using solution in codeplex http://ldapcp.codeplex.com/

to hide result form AD in people picker

$cpm = Get-SPClaimProviderManager
$ad = get-spclaimprovider -identity "AD"
$ad.IsVisible = $false


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.