1

I have a Sharepoint 2013 Server in our DMZ (non-Domain joined). Then I configured an Active Directory Import from our LAN to this DMZ server (so that we have our domain credentials to connect to the sharepoint sites).

After the import, I could see the User profiles in user profile service application - manage user profiles. (Example:) User Backup

Now I wanted to add this User to a Site. When I go to Site Settings - Site Permissions - Grant Permission I get the following error:

Add User Error

How can I add my users correctly to my Site? I really hope someone of you can help me.

EDIT: I share my screnario, so it's easier to understand.

I have a Sharepoint 2013 Server in our DMZ (non-Domain joined). Then I configured an Active Directory Import from our LAN to this DMZ server (so that we have our domain credentials to connect to the sharepoint sites). The server is accessable from the internet and the goal of the server is, to provide a data storage with onedrive for business.

  • Can you click on the red wavy line and see the account suggestions SharePoint makes? – TempaC Sep 30 '16 at 11:41
  • Sure. It says "No results found". I think that I have to configure something else after the AD import, but I don't know what exactly. – IT.Guy Sep 30 '16 at 12:02
  • It could be that since your SharePoint server is not domain joined, the domain is not automatically added to the people picker. Try running STSADM.exe -o setproperty -pn peoplepicker-searchadforests -pv “domain:aaa.com;domain:bbb.com” -url webappurl – James Grizzle Sep 30 '16 at 12:35
  • Thank you for clarifying your scenario. Who must get access to OneDrive for Business? External people, employees of your company, or both? – MHeld Sep 30 '16 at 13:03
  • 1
    If both of them already have an AD-Account in your domain, my recommendation below is exactly what you need. Implementing WAP is not the easiest job, but it's worth the effort. If you have F5 or Netscaler with Preauthentication module licensed, you may also use them instead. – MHeld Sep 30 '16 at 13:23
1

Unfortunately, providing access to SharePoint OnPremise over the internet is not an easy job. Especially if you want to make it secure and user-friendly.

It is not enough just to get a profile in UserProfile Service. If you want to give access to a SharePoint site, a user must have an account in one of the following things:

  • Active Directory (Requires SharePoint to be domain-joined)
  • FBA Membership provider (Stores Users in SQL-Database or LDAP-Directory instead of AD - requires FBA-configuration. I say FBA is a false friend. It is easy to configure, but has a lot of drawbacks in everyday use)
  • ADFS Federation (Hard to configure)

Unfortunately you didn't describe your scenario, but this might be a solution for you:

  • Optional: Move your SharePoint-Server to your LAN if internal users must have access
  • Join it to your existing ActiveDirectory Domain. Manage your user-accounts there.
  • Publish your SharePoint-Site to the Internet with a reverse-proxy like WebApplicationProxy. WAP includes a proxy-role running in DMZ to achieve security and user-friendly login with a HTML-Form.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.