SharePoint 2016 with FBA credential prompts when opening Office documents

Question

Can someone, please, share their experience in solving the problem with Office applications prompting for credentials? We've got FBA and Windows authentication in the default zone. Everything works fine. FBA works perfectly, Windows authentication works. However, when we are trying to open a Word document - we are presented with a login login page. For the sake of the argument, let's say it's OOB Login page. But we also have a custom login page that behaves exactly the same. When clicking on any Word document (docx), we are prompted with the login page (see screenshot below). That is only half of the problem. The biggest problem is that even if we authenticate one more time, the login page pops up over and over. It does not matter if we login with FBA or Windows. We've tried all sorts of combinations. It just keeps prompting forever.

We can live with Word prompting us from time to time, but after entering credentials we are not logged in. Popup window never disappears. I want to reiterate that this is happening with the OOB login page as well.

More info

• If we download the Word document - it opens fine.
• We are accessing the SharePoint 2016 website via the Internet from the computers that are not joined to the SharePoint domain.
• We don't have ADFS or ISA
• The main SharePoint Zone has both Windows and FBA authentication
• We are using SharePoint FBA Pack from Codeplex
• We've got custom login page. But using OOB login page behaves the same way. We still get prompted over and over again when opening Word documents

Things I've tried

• Connected to the site using FBA and AD credentials
• Added site to the Local intranet and selected "Automatic log-on with current username and password"
• Tried multiple client computers
• Tried setting "Open in browser" and "Open in Client application"
• Clicked "Remember credentials"
• Enabled and disabled "Client integration"
• Disabled or enabled anonymous access
• Tried adding registry key AuthForwardServerList to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
• Tried using custom or OOB login page
• Tried all browsers. They all behave same except for Firefox. It just openes the file in Word, but it's not connected to the website.
• Disabled or enabled "Site Lockdown"
• Tried adding < verbs applyToWebDAV="false" > < add verb="OPTIONS" allowed="false" /> <add verb="PROPFIND" allowed="false" /> </verbs> to web.config
• Restarted client computers

Any help will be greatly appreciated.

Answer 1

Looks like you are working with Office 2016. It has Modern Authentication enabled by default. There is a Registry-Key EnableADAL - try to disable it on your client. But be aware, this will break lots of cool stuff with Office365.

This is one of the many reasons why i do not like FBA: It's cheap, but has tons of drawbacks. Office-Integration is one of them. Implement WebApplicationProxy or even better AzureAD Application Proxy instead of FBA. It will save most or all of your external-sharing pains.

Answer 2

Here is the real solution that worked for me on two SharePoint 2016 farms with FBA.

Turns out that SecurityTokenService has SuppressModernAuthForOfficeClients property set to $false by default.

If we set it to $true and restart IIS - the miracle happens and Office accepts my credentials from now on.

$sts = Get-SPSecurityTokenServiceConfig
$sts.SuppressModernAuthForOfficeClients = $True
$sts.update()
iisreset

So I guess, this must be a crucial step when setting up FBA for SharePoint 2016. Without it - we just cannot work with office documents