0

I'm trying to setup my SharePoint search service application to use ADFS authentication when performing crawl of specific source.

On the following URL in CA i'm adding new crawl rule: http://server:34567/_admin/search/editcrawlrule.aspx?appid={7239c83c-d15e-42b6-8d7b-dacac1a3c23a}

In Crawl Configuration section i've selected "Include all items in this path", in "Specify Authentication" section i've selected " Specify form credentials".

In "Form URL:" i'm adding URL of my ADFS proxy logon URL, in my case it is: https://domainname/adfs/ls/idpinitiatedsignon/ (also i've tried different forms - like https://domainname/adfs/ls/ and so on).

When clicking on "Enter Credentials" button nothing is happened.

When checking this action in Fiddler i've noticed that the first POST action is performed: POST /_admin/search/FormsAuthenticationProxyPage.aspx?appid={7239c83c-d15e-42b6-8d7b-dacac1a3c23a} HTTP/1.1 with 201 response code

then GET action are performed: GET /_admin/search/FormsAuthenticationProxyPage.aspx?appid={7239c83c-d15e-42b6-8d7b-dacac1a3c23a} HTTP/1.1 GET /_admin/search/FormsAuthenticationProxyPage.aspx?appid={7239c83c-d15e-42b6-8d7b-dacac1a3c23a} HTTP/1.1

and the last GET has 401 response code.

According to HTTP response code table, this one means "Unauthorized". But i'm trying simply to open first ADFS login page to enter credentials - in my opinon no authorization should be performed at this moment.

So the question is - how to properly setup new crawl rule to utilize ADFS login page and provided credentials?

Thanks.

  • When trying to deeper investigate this problem i've checked the following page: serv:34567/_admin/search/FormsAuthenticationProxyPage.aspx. This page has the following source (partially omitted): function IFrameOnLoad() { document.getElementById('proxyContent').innerHTML = ''; if (confirm('Was the log on successful? Click Ok to store the credentials. Click Cancel to retry logging on to the form.')) So it looks like that is simply should display provided ADFS login page in IFrame but this isn't completed. – Sergey Nov 24 '15 at 22:38
1

As per the my knowldge, you cant crawl with ADFS authentication. You have to have the windows authentication. SharePoint search only crawl the windows authentication. This is by design.

  • In order for the SharePoint Search to crawl content we need to configure “Windows Authentication” on at least one zone in the Web Application.
  • You can enable the windows authentication on the same zone.

Check this one

  • I've already checked this one. If you look at the "Add crawl rule" page you will find that there is an option "Specify form credentials" . Also if you check technet.microsoft.com/en-us/library/jj219686.aspx#proc1, you will find the following: "To use form credentials for authentication, select Specify form credentials, type the form URL (the location of the page that accepts credentials information) in the Form URL box, and then click Enter Credentials. <...>" – Sergey Nov 24 '15 at 22:45
  • ok what account/ authentication is being used for crawling? – Waqas Sarwar MVP Nov 24 '15 at 22:53
  • Currently special crawl account is used for crawling all content sources. But the main reason is to use another one which can be authenticated through ADFS to crawl a specific source. – Sergey Nov 24 '15 at 23:02
  • it is not possible as i know. I even tested this thing with SharePoint 2016 beta 2....But still the issue is same. As per MSFT it is by design...You have to use the default access account for this...If a site to be crawled requires different credentials than those of the default content access account, create a crawl rule to specify the authentication credentials. – Waqas Sarwar MVP Nov 24 '15 at 23:11
  • Exactly - i need to use different credentials (different account) to crawl the required source. I've created a new crawl rule to specify credentials but the credentials which i require is an ADFS token, that's why i need to display ADFS login page. Because to obtain this token i have to open ADFS login page first, then enter my credentials, then the token is generated. Anyway, should i read it like "there is no OOTB functionality to access ADFS login page when creating new crawl rule"? – Sergey Nov 24 '15 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.