0

We are lookingto implement ADFS authentication in our SharePoint 2013 environment. We have two Active Directory domains: one for employees and one for external users. If we use the email address as the claim type for SharePoint and want to convert all users, including the external users, to ADFS, will we run into issues if there is any duplication of email addresses? The reason I ask is because the email address for external users is entered manually by our help desk, vs being populated as a part of the exchange account creation process for employees.

Also, what happens if an external user changes their email address (which happens regularly)? I would assume it shouldn’t have any impact since the real authentication to the ADFS servers occurs with their domain account. I just don’t know if SharePoint would suddenly see the new email address as a totally different account.

1

if there are more than one account with same email address it will cause the issue.

if the primary identification claim (email) changes, nothing in SharePoint will match, and the user will be considered completely separate.. all permissions and item tracking (tasks assigned, user profiles, etc) will effectively belong to a different user.

https://social.technet.microsoft.com/Forums/office/en-US/c4f0b4c8-de94-40c5-a5a2-cf9cbecd92ac/issue-with-adfs-trusted-provider-and-ad-having-2-users-with-same-email-address?forum=sharepointadmin

  • Thanks. That is really interesting because so many ADFS setup examples use the email address as the claim type. I think we definitely will be using the UPN, since that has to be unique in the forest and is far less likely to change. Appreciate the reply! – steveareeno Dec 5 '15 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.