1

I was wondering if someone could post some advise..

I've setup ADFS with Sharepoint 2016. It all works fine, when browsing to the SharePoint site, it re directs to the ADFS landing page, user can sign in and is redirected to SharePoint.

The issue I'm having is that internal users are also sent to the ADFS landing page when they access sharepoint. Is this normal? I assumed that ADFS would handle the login request by domain credentials and not pass though to ADFS internally.

Have i set something up wrong?

Improve this question
1

1 Answer 1

Reset to default
0

You have to configure a Split-DNS environment:

  • One Prerequisite: Configure SharePoint with one global URL for internal and external users (e.g. sharepoint.company.com instead of sharepoint.company.local). This will save you a lot of trouble.
  • If not already there, create your external Domain (company.com) in your internal DNS (usually ActiveDirectory DNS).
  • IMPORTANT: If you create the domain internally, your AD will no longer ask any Internet-DNS for this domain. So if you have a WebPage on www.company.com, it will no longer be reachable! You have to create each record also internally in your AD-DNS and point it to it's correct Internet IP-Address.
  • Create an A-Record for "sharepoint" and point it directly to the internal IP-Address of your SharePoint-Server. You completely skip your ADFS-Installation in that way and users will perform SingleSignOn via Kerberos/NTLM
  • Your "Internet Domain" should already be configured accordningly, as ADFS from external already works. No change needed here.
Improve this answer
9
  • Hi there, I already have an universal domain. My internal domain is .com just like external DNS.
    – Will Jones
    Commented Jun 29, 2017 at 18:02
  • and i also have an A record for sharepoint. pointing stright at the local IP on the sharepoint server. Internal users still get prompted to sign into adfs
    – Will Jones
    Commented Jun 29, 2017 at 18:05
  • Can you link an article, which describes your ADFS-Configuration? There are a lot of different implementation-scenarios.
    – MHeld
    Commented Jun 30, 2017 at 6:30
  • This is the guide i followed, dhavalcodes.com/Blog/…
    – Will Jones
    Commented Jun 30, 2017 at 11:43
  • Ah ok, you configured ADFS with a trusted identity provider. SharePoint will redirect you in that case to ADFS. Could you please update your question on what you want to achieve with your solution? Maybe there is another way than using the TrustedIdentityProvider.
    – MHeld
    Commented Jun 30, 2017 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.