Mixing FBA and custom STS - is it possible to have single user instead of two?

Question

I have a custom membership provider and plenty of FBA users with assigned groups. Now for example I have a user i:0#.f|fba|user1 and he belongs to three groups (Group1, Group2, Group3).

I've added ability to authenticate using custom STS, and if I'm authenticating using same user name through STS, sharepoint creates new record in UserInfo table i:05.t|sts|user1 and naturally it does not get any groups from existing user.

Is it possible somehow to tell Sharepoint, that those users should have same set of permissions, or to reuse existing fba user record if sts user name matches (in other words have several methods to login as same user - like many sites do - I can login to stackexchange using google/facebook/email and still end up with same user account)?

Or is it possible to authenticate as FBA user from external website (which is not a sharepoint website)?

Answer 1

Well AFAIK (and as opposed to what Nikhil says), it is not possible to "merge" your FBA and STS users. For instance, the meaning of your FBA claim (i:0#.f|fba|user1) is this:

• The part before the first | is created by Sharepoint; you can't modify it. It depends on the provider type, the identity claim, and other stuff. Details about this encoding may be found here: http://social.technet.microsoft.com/wiki/contents/articles/13921.sharepoint-2013-claims-encoding-also-valuable-for-sharepoint-2010.aspx
• The part in the middle is the name of your provider (fba or sts).
• The part on the right is the identifier of your user.

So when the same user connects using 2 different providers, he is seen by Sharepoint as 2 different users, with different rights. You may try to replace an identity claim with another one (but again, I don't think it's possible), however I would rather force your users to connect using only one provider.

Edit: this article explains how to migrate Windows-claims users to SAML-claims: http://blogs.technet.com/b/speschka/archive/2011/01/27/migrating-user-accounts-from-windows-claims-to-saml-claims.aspx

Maybe you can try to do the same, to migrate your FBA users to your STS users? So you would have only one identity for everyone, the STS one. Unfortunately, I don't know whether the MigrateUsers() method allows this. Anoter idea would be to iterate on all your sites, and modify the permissions (replace for instance "i:0#.f|fba|user1" with "i:05.t|sts|user1" everywhere).

Answer 2

In the Custom STS , while adding the to SharePoint group edit the code to add user with (i:0#.f|fba|user1) . Since Sharepoint knows both your authentication providers , it should accept it .