1

We had an existing web application using classic mode authentication. We changed the existing site to use Claims based authentication for Windows accounts and enabled Forms Based Authentication (FBA) by following this LINK.

After following this I am unable to log in with windows account. I am getting access denied error.

If I am adding domain users group into USER Policy with Full read access permission, then users able to log in with windows account. Even after adding this, I am opening any New Items in our custom lists showing New users need to Fill the form.

I need to fix this for existing users so they can use their same account without adding them into the USER Policy so they get same manage permissions as when the web application was in classic mode authentication.

or

In case if we are giving permission for domain users on USER Policy also, users should get log in permission and site permission as they had earlier.

For this what I need to change or What I need to do. Can you please anyone help me.

Thanks & Regards, Sree

Improve this question

2 Answers 2

Reset to default
2

You state in your question that your SP2010 Web Application was using Classic mode and you migrated it to Claims-based authentication using Windows NTLM. At the same time, you also enabled Forms Based Authentication.

The article you referenced in your question is for a new web application using Claims with both Windows and FBA authentication. The web application in this article never was configured to use classic mode.

This is not your situation as you are migrating from an existing web application where classic authentication is already enabled. The article you need to follow is here Part 2 with Part 1 located here as a reference. The MigrateUsers method on the SPWebApplication object is needed to convert the users to Claims mode. Powershell commands in the article explain how this is done.

Improve this answer
8
  • Hi Rich, Thanks for your needful Reply. I will go through that links and check my web application.
    – Sree
    Oct 12, 2011 at 12:34
  • Now My question is, In that web application (Default Zone) can I configure FBA with AD also after migrating to claims based.
    – Sree
    Oct 12, 2011 at 12:46
  • If by "FBA with AD" you mean a web application with a default zone that uses both Windows and Forms Authentication, then yes this is possible. I have configured web applications to do this and it works very well.
    – Rich Ross
    Oct 12, 2011 at 13:06
  • Thanks for your Reply... Let me do test, Existing web application migrating classic mode to claims based Authentication.
    – Sree
    Oct 15, 2011 at 13:23
  • Thanks Rich... I have tested its working fine. I have small doubt. Claims based user(domain\Testuser) and AD membership form user(Testuser) will be different account.
    – Sree
    Oct 21, 2011 at 16:21
0

If I understand you correctly, you just disabled Windows authentication in favor of Claims/FBA, in which case you will need to add users using those authentication providers as the source. Your site no longer honors Windows Authentication so it is responding as it should. If you need to access the same content via Windows Authentication then you may need to extend the web app again and set the authentication provider for the extension to Windows.

Improve this answer
1
  • I couldn't get your point. I had a Default zone site with classic mode. I have changed to Claims based with FBA. After doing this we couldn't login with AD users account Domain\user1. It was showing Access Denied. For solving / testing this I added domain users group into USER Policy with Full Read access. Then domain\user able to login the site. Now my question is without extending the existing site, we cannot use both logins?
    – Sree
    Oct 11, 2011 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.