Using powershell enable windows authentication on claims based authentication web application

Question

I am creating a web application using Claims based authentication as follows:

$databaseName = "WSS_Content_$port"
$authMethod = "NTLM"
write-host "Creating $title web application on port $port..."   

$waexe = "New-SPWebApplication -Name $title -ApplicationPool $title -ApplicationPoolAccount(Get-SPManagedAccount `$managedAccount)"
$waexe += " -Url $waurl -Port $port"
$waexe += " -DatabaseName $databaseName"
$waexe += " -AuthenticationMethod $authMethod"
$ap = New-SPAuthenticationProvider -ASPNETMembershipProvider $membership -ASPNETRoleProviderName $rolemanager               
$waexe += " -AuthenticationProvider `$ap"
$waexe += " -ErrorVariable err -ErrorAction SilentlyContinue"   
$waexe += " | Out-Null"     

write-host $waexe

Invoke-Expression $waexe

The above code creates web application with forms authetication. To make the crawl application index the content, I am enabling windows authentication using the following code:

function Update-IisSettings([string]$siteurl)
{
    $webapplication = Get-SPWebApplication $siteurl -ErrorVariable err -ErrorAction  SilentlyContinue       
    $iisSettings = $null
if($err -ne $null)
{
     write-error "Error while retrieving $siteurl web application."
     write-error "Error: $err"      
}   
if($webapplication -ne $null)
{
    $iisSettings = $webapplication.IisSettings.get_Item(0)      
}   
if($iisSettings -ne $null)
{
    $winAuthenticationProvider = New-Object Microsoft.SharePoint.Administration.SPWindowsAuthenticationProvider
    $winAuthenticationProvider.UseWindowsIntegratedAuthentication = $true       
    $iisSettings.AddClaimsAuthenticationProvider($winAuthenticationProvider)
    $iisSettings.UseWindowsClaimsAuthenticationProvider = $true
    $webapplication.Update
}
}

When i check in the Authenitcation Providers dialog for the web application, it displays both windows authentication and FBA are enabled. But the search is not working. It is failing with access denied error.

When i try to access the site, it shows me the page to select windows auth. or FBA. FBA works but when i select Windows auth., it fails with 404 error. When i verify in IIS manager, Windows authentication is shown as disabled for the web app. The site is not working even after i enable it.

I unchecked the Windows auth. in Authentication providers ui, saved it, opened the dialog again and checked Windows authentication. After enabling windows auth. through UI, the site is working. There is no difference between web.config before modifying using UI and after modifying using UI.

Is there anything else i have to perform when enabling windows auth. using powershell? My guess is my changes are not affecting IIS. They are updating only SharePoint settings.

One thing i have noticed in PowerGUI editor when debugging. Before modifying using UI, the ClaimsProviders collection in Default zone of WebApp.IISSettings property has FBA claims provider as first item followed by claims provider for windows. After modifying using UI, it is vice versa. Windows claims provider is listed first followed by FBA claims

Answer 1

It looks like you create the web application with the ASP.NET provider parameter set for New-SPAuthenticationProvider rather than TrustedIdentityTokenIssuer parameter set, did you cehck out the documentation on those parameter sets here?

Also check out this TechNet article that describes how to set this up using PowerShell