0

I am having a strange issue with my FBA authetication. I have a SharePoint site configured to use FBA with AD server. Recently I changed properties for few AD accounts. After that those users are not able to login to the SharePoint site. It simply says invalid password. The WFE is logging an error "An exception occurred when trying to issue security token: The security token username and password could not be validated.." whenever these users try to login. For all others it works perfectly.

here is the powershell I used to update the AD user account

if($state){
            Set-ADUser -Identity $uName -State $state
        }

I don't understand what is going wrong. Does this mean the "Set-ADUser" command corrupted the user accounts?

[UPDATE]

Found the problem but I do not know how to solve it. In the script mistakenly I added "-l" option. With this option the command corrupts the user account. Is there any way I can recover it?

Set-ADUser -Identity $uName -State $state -l $city

Please help.

Thank you

|improve this question
  • did you try restarting your Token service application pool ? – Arvi Jul 28 '16 at 0:43
  • Yes, I did that. But not working. In fact I have 2 farms sharing the same AD. Issue is there on both servers. Thats why I suspect that the powershell script that I ran might have corrupted the user account, but not sure – Arun Jul 28 '16 at 0:49
  • Did you try this on prod ? I think it takes AD at least a day to cycle thru – user17970 Jul 28 '16 at 1:01
  • I ran the script today and immediately the users started seeing login issue. So you mean I have to wait for one day? Why it is saying password incorrect? I have not changed the password. – Arun Jul 28 '16 at 1:05
  • 2
    Is "-l" short form of "-LogonWorkstations"? I cannot find "-l" at MSDN(technet.microsoft.com/en-us/library/ee617215.aspx) – Mark L Jul 28 '16 at 2:10
0

As Mark pointed out in his comment, the "-l" in the command "Set-ADUser" was a mistake and "userWorkstations" attribute got set with invalid values. Hence AD denied access and it reflected on FBA as invalid username and password. Ran another script to fix that attribute and all works fine now.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.