My SharePoint 2016 setup is configured with FBA going through a WAF (web application firewall / reverse proxy). Details include that it uses a customer Claims and Membership provider for login and to populate the People Picker.

To test the Membership/Claims configuration in isolation, I can configure the site for direct to the app using FBA (bypassing the WAF) and everything works fine. When the WAF (which handle user authentication, then passes credentials to FBA on the SharePoint server) is introduced, it cause the client object model to fail, but not to give an error. Using Fiddler/developer tools/Wireshark (on server), I can see the the XML query being passed to SharePoint consistently WAF and non-WAF configurations.

The failure scenario gets a 200 response with payload of


As far as I can tell, AAM (Alternate Access Mapping) is configured correctly with http://url and https://url configured since the host is passed through.

Nothing I can tell that is pertinent is shown in the ULS or event log.

There are difference in cookies/header where the WAF manages authentication (SAML), but the FedAuth cookie remains.

My production instance has HTTPS on both sides of WAF, so there is no transposing of HTTP/HTTPS and the issue remains.

I'm at a loss as to what is causing this behavior. Ideas?


The resolution was to turn off an obscure setting that was trying to be helpful and translate HTTPS/HTTP and according to technician, Encoded Chunking may also have been a factor. In sum, if a reverse proxy/waf messes with the packets, it may cause the client object model to fail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.