3

We converted our SharePoint 2013 environment to ADFS. I forgot to copy the prod versions of the my sites content DBs to the staging before the conversion. I was able to get the DBs copied over via this post here:

stack post

However, when I access the site collections in Central Admin, they have the NTLM user account as the Primary Site Collection Administrators instead of the ADFS account. When I try to access the my site url, I get "user not found". When I update the Primary Site Collection Administrators to the ADFS account, I can access the my site.

My question is, how to I change the primary site collection admins in central admin to the ADFS account without having to manually do each one? We have thousands. I have already converted the UPA to pull in the ADFS accounts and migrated all the users in the standard site collection to ADFS. I don't know if copying the my site DBs over after the conversion is the issue or if I am missing a step.

Thanks.

1

You can either use Convert-SPWebApplication to convert from Windows Claims to SAML Claims, or you can use Move-SPUser. Convert-SPWebApplication is probably the best route.

Migration of Windows claims authentication to SAML-based claims authentication in SharePoint Server 2013

  • I tried Convert-SPWebApplication and got errors. With the provider enabled: Convert-SPWebApplication : SAML based claim authentication is not compatible. With the provider disabled: Convert-SPWebApplication : There exists a zone with claims windows authentication enabled without SAML auth so we can't migrate safely. Maybe I'll have to look into Move-SPUser – steveareeno Jan 10 '18 at 20:12
  • You should fix the issue prior to performing any action. That error isn't any less applicable because of the route you plan on converting users from Windows Claims to SAML. – Trevor Seward Jan 11 '18 at 1:07
  • Dang, already did the Move-SPUser and it worked, but I see what your saying. Ugh. Thanks for the heads up. – steveareeno Jan 11 '18 at 16:16
  • So I have one more question. Does Convert-SPWebApplication basically handle everything in one nice command, instead of running a script to move the users individually? It also sounds like you can create a skip list to ignore service accounts. – steveareeno Jan 12 '18 at 15:03
  • Yes, it has some other logic to also make the process faster and a few more checks than Move-SPUser. – Trevor Seward Jan 12 '18 at 15:43
1

You can run the move-spuser against all users, here is nice script which will get the users from web application then convert them as required claims. (please test it first before directly applying to prod).

$groupprefix = "c:0-.t|awesome adfs|"

$userprefix = "i:05.t|awesome adfs|"

$usersuffix = "@awesomespaceships.com"

# Get all of the users in a web application

$users = Get-SPUser -web "https://sfb-sp15-wfe1:8080/"

# Loop through each of the users in the web app

foreach($user in $users)

{

# Create an array that will be used to split the user name

$a=@()

$userlogin = $user.UserLogin

$username = “”

if($userlogin.Contains("i:")) # for users

{

$a = $userlogin.split('\')

$username = $userprefix + $a[1] + $usersuffix

}

elseif($userlogin.Contains("c:")) # for groups

{

$a = $displayname.split('\')

$username = $groupprefix + $a[1]

}

if ($userName -Like ("*" + [Environment]::UserName +"*")) {

Write-Host "Skipping this user '$user' so as to not loose SPA full-control rights..."

}

else{

if ($userName -ne '') {

Write-Host "Moving '$user' to '$username'..."

Move-SPUser –Identity $user –NewAlias $username -ignoresid -Confirm:$false

}

}

}
  • That worked. Thanks. Afraid I might have jumped the gun per Trevor's comments. Luckily this is only our staging environment. – steveareeno Jan 11 '18 at 16:18
  • thats ok,over here we suggest the stuff but you have to test and pick one which is suitable for your environment. thats why we recommend test it before applying to production. – Waqas Sarwar MVP Jan 11 '18 at 16:23
  • right. I am finding converting to ADFS is no small matter. I may even perform the whole thing multiple times in staging until I am confident I can do this in my sleep. Thanks. – steveareeno Jan 11 '18 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.