1

The text is long but I tried to explain my scenario in detail so that it is easier to understand... I have a SharePoint 2013 deployment of a publishing web site that uses forms based authentication to log users into the web site. The web application has two zones with two different authentication providers configured:

  • Default: configured with Claims based Windows Integrated Authentication (NTLM) and anonymous access disabled

  • Extranet: configured with Forms Based Authentication and using a Membership and Role providers based on a ASP.NET Membership database in SQL Server. Anonymous access is enabled.

All web.config files (Central Admin, STS and Web application) are properly configured and tested based in the following article: https://blogs.technet.microsoft.com/ptsblog/2013/09/20/configuring-sharepoint-2013-forms-based-authentication-with-sqlmembershipprovider/. As the article explains, in these files, I configured:

  • People Picker Wildcard

  • Connection String

  • Membership Provider

  • Role Provider

The farm is composed by 2 servers:

  • 1 SharePoint server

  • 1 database server

The problem is that in the Default Zone used as a BackOffice by Windows Authenticated users, I cannot search for FBA users, just Windows domain users. I googled a while and found a lot of articles explaining the process of configuring FBA in SharePoint 2013 (including the one above) and all of them mention configuring mixed authentication in Central Admin (Application Management -> Manage Web Applications -> Authentication Providers), probably because on those scenarios they had an Intranet/Extranet solution. In fact, if I configure both Windows and FBA authentication in my Default zone, I am able to search for FBA users but if I only have Windows Authentication configured (as it makes sense, I don't have FBA uses to access the public web site's BackOffice), FBA users are not shown in People Picker controls and I am unable to grant permissions to these users as required.

So my questions is: Is there any way with just Windows Authentication (NTLM) configured in my Default zone authentication provider to be able to show FBA users in People Picker controls?

Although all articles I read mentioned in their examples to configure both NTLM and FBA authentication in the same authentication provider, it doesn't makes sense in public web sites where what we want is to a have public zone using FBA and a BackOffice using NTLM authentication.

This is a migration from SharePoint 2007 and in SP2007, the BackOffice (default zone) doesn't have FBA configured, just NTLM without anonymous access, while public zone has anonymous access enabled and FBA configured. This is precisely what I want to achieve in SharePoint 2013.

One big difference I noticed is in the web.config files, specically in the membership and roleManager sections:

  • In SharePoint 2007, the membership and roleManager sections are as follows, having the defaultProvider attributes configured to the names of the FBA providers.

    <membership defaultProvider="AspNetSqlMembershipProvider"> <providers> <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web,Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="aspnetdb" enablePasswordRetrieval="true" enablePasswordReset="true" requiresQuestionAndAnswer="false" applicationName="/" requiresUniqueEmail="false" passwordFormat="Encrypted" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="1" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordStrengthRegularExpression="" /> </providers> </membership> <roleManager enabled="true" defaultProvider="AspNetSqlRoleProvider"> <providers> <add connectionStringName="aspnetdb" applicationName="/" name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web,Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /> </providers> </roleManager>

  • In SharePoint 2013, the membership and roleManager sections are as follows, having the defaultProvider attributes configured to "i" and "c" due to claims based authentication used in SharePoint 2013. These values cannot be changed or we won't be able to authenticate using NTLM for our domain users in the Default zone.

    <membership defaultProvider="i"> <providers> <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" /> <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web,Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="aspnetdb" enablePasswordRetrieval="true" enablePasswordReset="true" requiresQuestionAndAnswer="false" applicationName="/" requiresUniqueEmail="false" passwordFormat="Encrypted" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="1" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" passwordStrengthRegularExpression="" /> </providers> </membership> <roleManager defaultProvider="c" enabled="true" cacheRolesInCookie="false"> <providers> <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" /> <add connectionStringName="aspnetdb" applicationName="/" name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web,Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /> <add name="FBARoleProvider" connectionStringName="FBADB" applicationName="/" type="System.Web.Security.SqlRoleProvider, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /> </providers> </roleManager>

As I said, in SharePoint 2007 I don't have to have FBA configured in my BackOffice zone (Default zone in authentication providers) and somehow SharePoint seems to know where to look for the users (the aspnetdb database), probably using the defaultProvider attribute. In SharePoint 2013, the defaultProvider attribute must be set "i" and "c" in membership and roleManager sections due to Claims based authentication and the only way SharePoint 2013 seems to know where to look for the users is if we configure FBA in the Default authentication provider in Central Admin and setting the name of both membership and role providers correctly there.

The only solution I have so far, is to have a second web application extension with both NTLM and FBA configured just for the sake of being able to look for FBA users in People Picker controls and then grant permissions to these users. I would like to avoid this solution and having a single BackOffice configured with just NTLM and being able to look for FBA users in People Picker controls being authenticated with a Windows domain user.

Anyone can help?

Thanks,

Miguel Isidoro

Improve this question

2 Answers 2

Reset to default
1

To copy and paste my answer here from TN,

All zones in which you need access to FBA users must be configured to support FBA. The current context of the user performing the query must have visibility into the FBA configuration, which of course is bubbled up via the web.config. If your Default zone does not have the web.config configured for FBA, then it cannot 'see' it nor the FBA users contained within the data store.

Improve this answer
1
  • To continue with what Trevor said, this is one of those deceptively easy things. All you have to do is add the references to the web.config on your default windows authentication zone. This won't change your authentication.
    – Jack
    May 17, 2017 at 12:11
1

Continuing to post an example

The machineKey must also match up with the FBA web.config

That's it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.