I have setup a web app in SP2010 with ADFS and NTLM authentication enabled. We have code that runs SPUser.EnsureUser() that fails looking up a user account that exists in the hidden user list (/_catalogs/users/simple.aspx) and can/has logged into the site collection. I have found some interesting behavior with this scenario and I am confused/unsure why this happening. Following is what I have found:
- If I give the user account an email address in the hidden user list EnsureUser works (user does not have one in AD).
- User accounts that have logged in using ADFS work.
- User accounts that have logged in using NTLM do not work unless they have an email address.
- User accounts that do have an email address in AD and/or SharePoint work just fine.
- If a web application is setup for Claims but has not had a membership provider configured (so just using AD auth) EnsureUser works.
- If I setup ADFS to use the email address as the identifier rather than SamAccountName EnsureUser works.
- I have tried user, domain\user, and firstname.lastname@example.org with no effect.
- The claim ID of the NTLM users look correct (i:0#.w|domain\user) (as far as I can tell).
The ADFS instance that isn't working is sending claims for WindowsAccountName, email, and Name (mapped to SamAccountName, email, and DisplayName, respectively)(I followed these steps to setup ADFS. Only difference is I added the other two claim mappings). The ADFS instance that is working is mapping email and display name only with email being the unique identifier in SharePoint.
From what I have read online it seems like the membership providers are stepping on each other. However, if that is the case then I understand why the one ADFS instance that is working is working (different identifiers), but why would having an email address or not matter to the site collection that isn't? Or is EnsureUser actually complaining because it is finding two user accounts (AD and ADFS) and throwing the wrong error?