1

I was wondering how to deal with claims based SharePoint sites related to login from other devices. An example:

I have a SharePoint site setup with claims based authentication for both Active Directory and forms users. This presents the user with a login form in which he or she has to choose their way of logging in.

Now from different applications, for instance SharePlus on iPad, you have the option to connect to SharePoint. But these applications usually expect a HTTP/NTLM challenge request from the server. When presented with the custom login page, they don't login and display an error.

I can handle this problem in two different ways: - Extend the application and make an entry which only supports NTLM login. But that means there are to different URLs to the same site and people working together on these sites cannot share their URLs with eachother (mailing links and such...). Annoying. - Explain users that they can use http://www.site.com/_windows/default.aspx?ReturnUrl=/subsite to login. This URL will give a NTLM challenge and afterwards automatically redirect to the correct content. Works, but not real userfriendly.

In both options, this also means blocking out the forms based users from using these apps. Ok, you might argue that the application itself should support other ways of logging in and perhaps show the login form from sharepoint to query for the correct security token; but in reality they just don't.

In the best case scenario; this should work for all users and just by entering the URL of the site and their username and password. But I cannot just use NTLM and skip the login form: that login form is a requirement.

Improve this question

2 Answers 2

Reset to default
1

Not sure if this helps, but here are a couple of points to be aware of:

  • In SP 2010 you can have both Windows Auth and Forms auth on the same web application. By default when you do so, the login form first requires the user to choose which form of authentication is used.
  • If you put X-FORMS_BASED_AUTH_ACCEPTED = "f" on the http request header it bypasses the login form mentioned immediately above and does a challenge response (e.g., NTLM).
Improve this answer
1
  • Hi Kirk, thanks. The http request header might be usefull in software, but that only goes for software you actually built. Not that easy to integrate in existing apps :) As for the authentication, it's that login form which sometimes screws up client software. Mostly you just need to enter url, username and password. It passes that to SharePoint, but the login form doesn't know what to do with it. It would be better if it would check with each authentication provider and just login when one matches. The only requirment there is the username begin unique across all providers.
    – Jasper
    Commented Jun 24, 2011 at 12:55
0

If you had a special URL for your iPad users to use for login, changing nothing else, does this solve your problem?

For example, did you try adding _layouts/mobile/mbllogin.aspx to your root URL? This is an FBA login, but it should display on an iPad.

rlr

Improve this answer
2
  • Nope I didn't try that, but I will. But it's not only mobile devices having these kind of problems, I've seen some other client side software (windows apps) which seem to struggle with the same things.
    – Jasper
    Commented Jun 24, 2011 at 12:45
  • By the way, this isn't very different then using the _windows/default.aspx approach, which I don't find very userfriendly.
    – Jasper
    Commented Jun 24, 2011 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.