0

perhaps this question is based on totally wrong idea so please point me to right direction, anyway, we have two SharePoint farms, one 2013 with ADFS claims, second 2010 with NTLM. What we would like to do is to let 2013 crawler collect content of 2010 and have only one SP2013 Search Center for both farms.

The problem is in how results are filtered. If we open SP2013 Search Center in NTLM zone results from SP 2010 are shown, if we open it in ADFS zone, they are filtered out. (As strange as it sounds we have not found anything about it on Google, like nobody had this problem before)

Our idea is to use ISecurityTrimmerPre to add missing claims but unfortunately it does not work. NTLM claims look like this (my JSON formatting)

{
     "OriginalIssuer": "SecurityTokenService",
     "Issuer": "SharePoint",
     "ClaimType": "h__p://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
     "Value": "0#.w|d-ploy\\ovalenta",
     "ValueType": "h__p://www.w3.org/2001/XMLSchema#string"
   },
   {
     "OriginalIssuer": "Windows",
     "Issuer": "SharePoint",
     "ClaimType": "h__p://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",
     "Value": "S-1-5-21-4234060112-2975725948-374018825-513",
     "ValueType": "h__p://www.w3.org/2001/XMLSchema#string"
   },


 , but ADFS looks like this {
     "OriginalIssuer": "SecurityTokenService",
     "Issuer": "SharePoint",
     "ClaimType": "h__p://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
     "Value": "0e.t|dploy  adfs|ondrej.valenta@d-ploy.ch",
     "ValueType": "h__p://www.w3.org/2001/XMLSchema#string"
   }

So the ultimate question is "What claims to add in pre trimmer so the NTLM results from SP2010 are shown?"

I have tried to add all from NTLM search (with all groupsid etc.) but that does not work.

  • Thanks for the edits, guys. But how about some answers :-)) But I'm an realist, I guess there are like 3 people outside Microsoft that know the answer. – Ondrej Valenta Aug 13 '15 at 11:20
  • Just an update. The problem seems to be in how security tree is generated by Microsoft.Ceres.InteractionEngine.Processing.BuiltIn.SecurityPreFilterProducer. It seems like claims added in ISecurityTrimmerPre have lower value than claims added by SharePoint/ADFS provider. For example, if you store temporarily claims that came to AddAccess method, clear the claims if the user and return the temporarily stored original claims at the end of the method, search won't find a thing, which is strange when in fact claims have not changed at all. – Ondrej Valenta Aug 14 '15 at 9:08
  • After some digging I found out it cannot be probably done. Whole problem lays in ClaimConverterProducer respectively FastSecurityEncoder. ClaimsConverterProducer has two methods for claims encoding from SP ACL (HandleNtValue and EncodeClaim), these generates two different strings.When you ask Query component for results in NTLM zone claims are converted to format of HandleNtValue, but in ADFS zone they are converted in EncodeClaim format, so they will never match, no matter what claim you put in the ISecurityTrimmerPre.Own Ceres module added to Query processing is probably the right way. – Ondrej Valenta Aug 14 '15 at 15:12
0

One actually has to look elsewhere to solve this. The problem lays in ADFS and what kind of claims it sends to Query Processing pipeline.

More detailed answer with powershell scripts here.

Update as requested

The ways how ACL NTLM "claims" are encoded by Content Processing Component while crawling SharePoint 2010 content, Query Processing Component that receives all user claims and encodes them at the begining of the query and ISecurityTrimmerPre are different.

CPC and QPC(at the begining of the query processing) use the same encoder, but (for some reason) ISecurityTrimmerPre uses different, specifically FastSecurityEncoder) so you will never be able to get the same encoded value for NTLM claims by just simply adding the NTLM claim, like Group SID, with ISecurityTrimmerPre. That is simply not possible.

Fortunatelly the problem lays elsewhere. All you have to do is to setup your ADFS server to send Group SID, Primary SID and a special group SID claim for NT AUTHORITY/Authenticated users and add mappings to ADFS authentication provider. This way Query Processing Component will receive the right claims at the begining of the processing and encodes them with the right encoder.

  • 2
    Can you please update your post with the relevant parts from your blog post, blogs have been known to disappear and if that would be the case, the information would be lost. – Eric Alexander Oct 26 '15 at 2:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.