0

Although there are tons of information about this, I could not find single place, where it would be described how it actually works.

Situation is this, in WSS 3.0 we were using external user id (long) as user name (in database that was tp_login field), now we are migrating to claims with using custom STS and if I understand correctly, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name is reserved, so when I register New-SPTrustedIdentityTokenIssuer I can't map to it my previous user id.

Many examples use email as IdentifierClaim, but I don't understand how it maps to database field, also my identifier is not email, so wondering how should I map it, should I perform any configuration after registering identity token issuer, to say how it relates to database fields or I misunderstand something fundamentally?

Update

After digging more, I think I candescribe my problem in a shorter way:
I have a user in database i:0#.f|fbamembers|user1 and it has own permissions, etc.

When I connect using custom sts user identity looks like:
i:05.t|wsfederationsts|user1. Is there a way, that I could map sts user to forms user and would not need to duplicate all the permissions?

1

About the mapping of "http://schemas.xmlsoap.org/.../name":

The New-SPTrustedIdentityTokenIssuer cmdlet has a parameter "-IdentityClaim". The claim type you specify as an identity claim is "encoded" by Sharepoint into the "http://schemas.xmlsoap.org/.../name" claim. I don't think you must configure anything special here, just specify a claim sent by your custom STS when you create your trusted token issuer.

Note: from Sharepoint point of view, if 2 users have 2 different identity claims, then they are 2 different people (and it creates 2 MySites for instance).

The database field:

The user identifier is still stored in the tp_Login field. You should see the value of the "http://schemas.xmlsoap.org/.../name" claim in the tp_Login field. If you don't see this value there, then it means you must migrate your users somehow (from their old identifier, to their new "claims-based" identifier).

  • I added update with more specific problem description. – Giedrius Sep 24 '14 at 7:40
  • I posted an answer to your other questions. AFAIK, no it is not possible to merge both users. 2 different providers = 2 different identifiers in Sharepoint = different rights = different MySite too. – Matthieu Sep 25 '14 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.