Although there are tons of information about this, I could not find single place, where it would be described how it actually works.

Situation is this, in WSS 3.0 we were using external user id (long) as user name (in database that was tp_login field), now we are migrating to claims with using custom STS and if I understand correctly, http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name is reserved, so when I register New-SPTrustedIdentityTokenIssuer I can't map to it my previous user id.

Many examples use email as IdentifierClaim, but I don't understand how it maps to database field, also my identifier is not email, so wondering how should I map it, should I perform any configuration after registering identity token issuer, to say how it relates to database fields or I misunderstand something fundamentally?


After digging more, I think I candescribe my problem in a shorter way:
I have a user in database i:0#.f|fbamembers|user1 and it has own permissions, etc.

When I connect using custom sts user identity looks like:
i:05.t|wsfederationsts|user1. Is there a way, that I could map sts user to forms user and would not need to duplicate all the permissions?

1 Answer 1


About the mapping of "http://schemas.xmlsoap.org/.../name":

The New-SPTrustedIdentityTokenIssuer cmdlet has a parameter "-IdentityClaim". The claim type you specify as an identity claim is "encoded" by Sharepoint into the "http://schemas.xmlsoap.org/.../name" claim. I don't think you must configure anything special here, just specify a claim sent by your custom STS when you create your trusted token issuer.

Note: from Sharepoint point of view, if 2 users have 2 different identity claims, then they are 2 different people (and it creates 2 MySites for instance).

The database field:

The user identifier is still stored in the tp_Login field. You should see the value of the "http://schemas.xmlsoap.org/.../name" claim in the tp_Login field. If you don't see this value there, then it means you must migrate your users somehow (from their old identifier, to their new "claims-based" identifier).

  • I added update with more specific problem description.
    – Giedrius
    Commented Sep 24, 2014 at 7:40
  • I posted an answer to your other questions. AFAIK, no it is not possible to merge both users. 2 different providers = 2 different identifiers in Sharepoint = different rights = different MySite too.
    – Matthieu
    Commented Sep 25, 2014 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.