3

We converted our SharePoint 2013 environment to ADFS. I forgot to copy the prod versions of the my sites content DBs to the staging before the conversion. I was able to get the DBs copied over via this post here:

stack post

However, when I access the site collections in Central Admin, they have the NTLM user account as the Primary Site Collection Administrators instead of the ADFS account. When I try to access the my site url, I get "user not found". When I update the Primary Site Collection Administrators to the ADFS account, I can access the my site.

My question is, how to I change the primary site collection admins in central admin to the ADFS account without having to manually do each one? We have thousands. I have already converted the UPA to pull in the ADFS accounts and migrated all the users in the standard site collection to ADFS. I don't know if copying the my site DBs over after the conversion is the issue or if I am missing a step.

Thanks.

2 Answers 2

1

You can either use Convert-SPWebApplication to convert from Windows Claims to SAML Claims, or you can use Move-SPUser. Convert-SPWebApplication is probably the best route.

Migration of Windows claims authentication to SAML-based claims authentication in SharePoint Server 2013

7
  • I tried Convert-SPWebApplication and got errors. With the provider enabled: Convert-SPWebApplication : SAML based claim authentication is not compatible. With the provider disabled: Convert-SPWebApplication : There exists a zone with claims windows authentication enabled without SAML auth so we can't migrate safely. Maybe I'll have to look into Move-SPUser Jan 10, 2018 at 20:12
  • You should fix the issue prior to performing any action. That error isn't any less applicable because of the route you plan on converting users from Windows Claims to SAML.
    – user6024
    Jan 11, 2018 at 1:07
  • Dang, already did the Move-SPUser and it worked, but I see what your saying. Ugh. Thanks for the heads up. Jan 11, 2018 at 16:16
  • So I have one more question. Does Convert-SPWebApplication basically handle everything in one nice command, instead of running a script to move the users individually? It also sounds like you can create a skip list to ignore service accounts. Jan 12, 2018 at 15:03
  • Yes, it has some other logic to also make the process faster and a few more checks than Move-SPUser.
    – user6024
    Jan 12, 2018 at 15:43
1

You can run the move-spuser against all users, here is nice script which will get the users from web application then convert them as required claims. (please test it first before directly applying to prod).

$groupprefix = "c:0-.t|awesome adfs|"

$userprefix = "i:05.t|awesome adfs|"

$usersuffix = "@awesomespaceships.com"

# Get all of the users in a web application

$users = Get-SPUser -web "https://sfb-sp15-wfe1:8080/"

# Loop through each of the users in the web app

foreach($user in $users)

{

# Create an array that will be used to split the user name

$a=@()

$userlogin = $user.UserLogin

$username = “”

if($userlogin.Contains("i:")) # for users

{

$a = $userlogin.split('\')

$username = $userprefix + $a[1] + $usersuffix

}

elseif($userlogin.Contains("c:")) # for groups

{

$a = $displayname.split('\')

$username = $groupprefix + $a[1]

}

if ($userName -Like ("*" + [Environment]::UserName +"*")) {

Write-Host "Skipping this user '$user' so as to not loose SPA full-control rights..."

}

else{

if ($userName -ne '') {

Write-Host "Moving '$user' to '$username'..."

Move-SPUser –Identity $user –NewAlias $username -ignoresid -Confirm:$false

}

}

}
3
  • That worked. Thanks. Afraid I might have jumped the gun per Trevor's comments. Luckily this is only our staging environment. Jan 11, 2018 at 16:18
  • thats ok,over here we suggest the stuff but you have to test and pick one which is suitable for your environment. thats why we recommend test it before applying to production.
    – Waqas Sarwar MVP
    Jan 11, 2018 at 16:23
  • right. I am finding converting to ADFS is no small matter. I may even perform the whole thing multiple times in staging until I am confident I can do this in my sleep. Thanks. Jan 11, 2018 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.