I have extended the web application and enabled form based authentication with a different host name and I have created a new host name site collection with host header application pointing to host header of extended application.

site collection has been created but when i access in the browser it is not showing me login page, it is asking for user id and password on a popup windows as normal windows authentication enabled application asks.

I have not done any web configuration changes yet, I am just checking that specifying FBA option in extending a web application shows login page or not.

PS C:\Windows\system32> $ap = New-SPAuthenticationProvider -ASPNETRoleProviderName customroleprovider -ASPNETMembershipP rovider custommembershipprovider 
PS C:\Windows\system32> Get-SPWebApplication -Identity "http://localspdev13-1" | New-SPWebApplicationExtension -Name "Extra netSite" -HostHeader www.extranet.alidev.local -Zone Extranet -URL "http://extranet.alidev.local" -Port 80 -AuthenticationP rovider $ap
PS C:\Windows\system32> New-SPSite "http://test.alidev.local" - HostHeaderWebApplication "http://extranet.alidev.local" - Name "Portal" -Description ‘Customer root’ -OwnerAlias "alidev\spsitecoladmin" -language 1033 -Template "STS#0"

2 Answers 2


As Far as I know, you have to make changes in the web.config file. IIS read from the config file and if you did not enable over their then it will not work.I think it is better to make changes to web config file.

Did you enable the NTLM(windows) authentication as well?

  • I have enabled only FBA. See powershell for more detail.
    – Ali
    Apr 21, 2015 at 1:35
  • 1
    then it should not give you the windows auth, Can you check from Central admin, AAM settings as well as see if extranet zone configured properly with FBA.
    – Waqas Sarwar MVP
    Apr 21, 2015 at 2:36
  • I can see "extranet.alidev.local" defined in extranet zone. I am creating a host name site collection with host header to extended web application, is that right step?
    – Ali
    Apr 21, 2015 at 2:40
  • 1
    i think you can not create FBA with HNSC on extranet zone. Becuase Extendid Web application is at Web App level not the site collection.check this blogs.msdn.com/b/brian_farnhill/archive/2014/07/08/…
    – Waqas Sarwar MVP
    Apr 21, 2015 at 2:52
  • 1
    you do not have the ability to provide different authentication mechanisms based on the host header blogs.msdn.com/b/kaevans/archive/2012/03/27/…
    – Waqas Sarwar MVP
    Apr 21, 2015 at 2:54

The web application also needs to use Claims Based authentication. It that is set then you next step should be to update the web.config files, it is a manual step.

You need to update the web.config for your FBA enabled web applications, central administration and the STS web.config. The STS web.config is found here %programfiles%\common files\Microsoft Shared\web server extensions\14\WebServices\SecurityToken

In each of the web.config's add a connection string for your custom providers, both the role and membership ones. Which parameters are needed depends on them, example below is for OOTB ASP.Net provider

> <connectionStrings><add name="SQLConnectionString"
> connectionString="data source=SQL;Integrated Security=SSPI;Initial
> Catalog=SQL-Auth" /></connectionStrings>

add the your providers to the section, do not remove or change the default providers.

<roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false">

<add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<add connectionStringName="SQLConnectionString" applicationName="/" description="Stores and retrieves roles from SQL Server" name="SQL-RoleManager" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />

<membership defaultProvider="i">

<add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

<add connectionStringName="SQLConnectionString" passwordAttemptWindow="5" enablePasswordRetrieval="false" enablePasswordReset="false" requiresQuestionAndAnswer="true" applicationName="/" requiresUniqueEmail="true" passwordFormat="Hashed" description="Stores and Retrieves membership data from SQL Server" name="SQL-MembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />


Also make sure the your IIS web application is set to use Form based authentication. If you are using both FBA.

Hope this helps, i just activated this for the first time last week on a web application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.