I have a user that is logged into SharePoint via Claims Authentication and a custom STS. This provides the following claims:

I need these users to be authenticated in some way against Active Directory also, because they need to access data that is held within Microsoft Analysis services. Is this where it is appropriate to try and set up impersonation with kerberos in some way? The claims windowsaccountname and mail should correspond to those within the user's corresponding AD account, so is this at all possible?

2 Answers 2


Note that only Windows claims accounts can be used in delegation scenarios. AS requires delegation properly configured and the reason for the previous constraint is the C2WTS process that converts claims to windows tokens. In SharePoint only Windows claims can be converted to Windows token. That was some background...

So, you should use the SharePoint STS if you need this delegation for AS.


You can get a Windows user token from claims using the Claims to Windows Token Service (which is a windows service) - here is an example on how to use it: http://blogs.objectsharp.com/cs/blogs/steve/archive/2010/09/10/converting-claims-to-windows-tokens-and-user-impersonation.aspx

I am not sure how good an approach this is...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.