1

I seem to have an orphaned custom claims provider. I removed the solution from the farm and When I run Get-SPClaimProvider it doesn't show as a provider.

However, the people picker is still using it. I know this because when I type a name in it I still get the custom claim user. I tried to remove it using Remove-SPClaimProvider but it doesn't see it any more.

Anyway I can reset this?

Edit:

I deselected the trusted provider on all web apps

I removed my custom provider solution/feature

I completed removed the ADFS trusted identity provider from SP:

Remove-SPTrustedRootAuthority -Identity "ADFS Token Signing Cert Parent"
Remove-SPTrustedIdentityTokenIssuer "ADFS SAML Provider for SharePoint"

At this point, when I go into a people picker on a site, I am still getting the ADFS name resolution results showing up. Notice in the image I get two results for one user, one is for ADFS.

enter image description here

When I run Get-SPClaimProvider, the custom claim provider does not show up. Maybe this is expected since I uninstalled the custom provider but why does the people picker still show the results?

The problem I am having is I had changed the custom provider to use the UPN instead of email address. After deploying the new version I cannot get SP to recognize the it now. When I run the following cmd it complains that "ADFSClaimProvider" doesn't exist:

$ap = Get-SPTrustedIdentityTokenIssuer "ADFS SAML Provider for SharePoint"
$ap.ClaimProviderName = "ADFSClaimProvider"
$ap.Update()

I was suspecting it wasn't working because, for whatever reason, SP thinks a custom provider already exists.

Improve this question

2 Answers 2

Reset to default
0

here are the steps to remove the custom claim provider.

  1. Change your web apps to no longer use the SPTrustedIdentityTokenIssuer. For example, change them to use Windows claims.
  2. Delete the SPTrustedIdentityTokenIssuer.
  3. Create a new SPTrustedIdentityTokenIssuer with the same settings, only don’t configure it to use your custom claims provider as the default provider.
  4. Reconfigure your web apps to use the recreated SPTrustedIdentityTokenIssuer.

https://samlman.wordpress.com/2015/02/28/more-information-on-adding-and-changing-custom-claims-providers-in-sharepoint-2010/

Improve this answer
7
  • Thanks Waqas, I did that a couple of times already to no avail. I updated my original post.
    – steveareeno
    Dec 6, 2015 at 15:55
  • From central admin can you see if solution is still showing active on Web app? I would also recycle timer n admin jobs
    – Waqas Sarwar MVP ♦
    Dec 6, 2015 at 15:58
  • I verified each time I went through these steps that the feature was gone from the web app. I even made a point of deactivating it before retracting and deleting it. I didn't recycle the time job though. I will do it again and try this.
    – steveareeno
    Dec 6, 2015 at 16:05
  • unfortunately, recycling the timer job didn't help. The people picker is still showing results from the claim provider
    – steveareeno
    Dec 6, 2015 at 17:18
  • how many server in the farm and web app? have you tried clear to config cache on all servers?
    – Waqas Sarwar MVP ♦
    Dec 7, 2015 at 1:09
0

I open a support call with Microsoft and the engineer had me reset the people picker using stsadm:

stsadm.exe -o setproperty -pn peoplepicker-searchadforests -pv "" -url "https://sharepoint"

Simple.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.