0

I have a custom membership provider and plenty of FBA users with assigned groups. Now for example I have a user i:0#.f|fba|user1 and he belongs to three groups (Group1, Group2, Group3).

I've added ability to authenticate using custom STS, and if I'm authenticating using same user name through STS, sharepoint creates new record in UserInfo table i:05.t|sts|user1 and naturally it does not get any groups from existing user.

Is it possible somehow to tell Sharepoint, that those users should have same set of permissions, or to reuse existing fba user record if sts user name matches (in other words have several methods to login as same user - like many sites do - I can login to stackexchange using google/facebook/email and still end up with same user account)?

Or is it possible to authenticate as FBA user from external website (which is not a sharepoint website)?

1

Well AFAIK (and as opposed to what Nikhil says), it is not possible to "merge" your FBA and STS users. For instance, the meaning of your FBA claim (i:0#.f|fba|user1) is this:

So when the same user connects using 2 different providers, he is seen by Sharepoint as 2 different users, with different rights. You may try to replace an identity claim with another one (but again, I don't think it's possible), however I would rather force your users to connect using only one provider.

Edit: this article explains how to migrate Windows-claims users to SAML-claims: http://blogs.technet.com/b/speschka/archive/2011/01/27/migrating-user-accounts-from-windows-claims-to-saml-claims.aspx

Maybe you can try to do the same, to migrate your FBA users to your STS users? So you would have only one identity for everyone, the STS one. Unfortunately, I don't know whether the MigrateUsers() method allows this. Anoter idea would be to iterate on all your sites, and modify the permissions (replace for instance "i:0#.f|fba|user1" with "i:05.t|sts|user1" everywhere).

  • Thanks, I'll take a closer look to migration, although I'm pretty sure that there will be another problem with it because of our specific configuration. – Giedrius Sep 25 '14 at 19:24
  • Another idea: use the Move-SPUser cmdlet to migrate your FBA users to SAML users. No need to write code, just some Powershell. – Matthieu Sep 26 '14 at 7:48
  • Something like this: blogs.technet.com/b/meamcs/archive/2011/03/12/… – Matthieu Sep 26 '14 at 7:49
0

In the Custom STS , while adding the to SharePoint group edit the code to add user with (i:0#.f|fba|user1) . Since Sharepoint knows both your authentication providers , it should accept it .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.