How can I map a user authenticated via Claims Authentication to Active directory account?

Question

I have a user that is logged into SharePoint via Claims Authentication and a custom STS. This provides the following claims:

• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/windowsaccountname
• http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mail

I need these users to be authenticated in some way against Active Directory also, because they need to access data that is held within Microsoft Analysis services. Is this where it is appropriate to try and set up impersonation with kerberos in some way? The claims windowsaccountname and mail should correspond to those within the user's corresponding AD account, so is this at all possible?

Answer 1

Note that only Windows claims accounts can be used in delegation scenarios. AS requires delegation properly configured and the reason for the previous constraint is the C2WTS process that converts claims to windows tokens. In SharePoint only Windows claims can be converted to Windows token. That was some background...

So, you should use the SharePoint STS if you need this delegation for AS.

Answer 2

You can get a Windows user token from claims using the Claims to Windows Token Service (which is a windows service) - here is an example on how to use it: http://blogs.objectsharp.com/cs/blogs/steve/archive/2010/09/10/converting-claims-to-windows-tokens-and-user-impersonation.aspx

I am not sure how good an approach this is...