1

When I try to add an ADFS user to the 'Administrators for User Profile Service' list through Central Administration I get the error 'Specified argument was out of the range of valid values. Parameter name: claim'.

UPS Admin

Trying to add via PowerShell via the following command gives the same error:

$serviceapp = Get-SPServiceApplication myApplicationId
$security = Get-SPServiceApplicationSecurity $serviceapp -Admin
$principalUser = New-SPClaimsPrincipal -Identity "i:0e.t|adfs|me@domain.com" -IdentityType EncodedClaim
Grant-SPObjectSecurity $security -Principal $principalUser -Rights "Full Control"
Set-SPServiceApplicationSecurity $serviceapp -ObjectSecurity $security -Admin

ULS logs the following error as well: The claim 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn: me@domain.com' could not be added to the delegated administrators group because it does not represent a user or security group.

Also, when I try to give an ADFS user Connection Permissions to the User Profile Service through Central Administration, I get the error, "The User Profile Service Requires domain credentials for connection access":

Connection Permissions

How do you add ADFS users as User Profile Service Administrators?

  • Is your sharepoint configured to use users from ADFS? – martusha May 23 '16 at 13:28
  • On this link sharepointobservations.wordpress.com/2013/08/19/… on the second part about "Configure SharePoint Web Application" is guide how to configure everything correctly. Hope this helps. – martusha May 23 '16 at 13:32
  • SharePoint is configured to use ADFS. My question is solely how to add ADFS users as User Profile Service Administrators. – James Grizzle May 23 '16 at 14:17
1

Only Windows (Domain) users can be added to Service Application security.

  • Given the scenario of an ADFS only deployment (other than Central Admin), how could an admin delete a Newsfeed post? – James Grizzle May 23 '16 at 14:33
  • Well, given you need to have a Windows Claims enabled zone, in that case they would need to use that zone instead of their ADFS credentials. – Trevor Seward May 23 '16 at 14:45
  • By ADFS only, I meant that there is no available Windows Claim Zone. – James Grizzle May 23 '16 at 15:34
  • Then Search won't function, which is typically important. – Trevor Seward May 23 '16 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.