We have webapplication extended to provided windows auth on one zone and SAML Auth using ADFS on second zone. We have SharePoint servers let's say on Contoso.com and users are Foo.com domain. This Foo.com domain has ADFS server configured for SAML authentication. My question is can i use same Foo.Com users for windows authentication meaning same domain users login using different authentication providers ? If yes , what should be direction of one way trust between domains ?

Please advise

Thanks, Ronak

1 Answer 1


No, you should never mix two forms of authentication for the same user as SharePoint will see them as two distinct objects; this can cause issue with apps that rely on the UPSA, such as Workflow Manager.

  • Thanks Trevor. We are not using Workflow Manager or not planning to use in future. Do you think even SharePoint will allow to authenticate users from Foo.com ? I can't get it People picker to search users from foo.com.
    – Ronak
    Commented Jan 28, 2018 at 13:56
  • Yes, if you have a one-way trust in place you can auth and use the People Picker. See thesharepointfarm.com/2014/01/… for details on how to set it up. But in this scenario, you would not use ADFS at all.
    – user6024
    Commented Jan 28, 2018 at 17:10
  • Thanks Trevor. Yes we are in identity mess as of now. We need to do this Report Builder does not work with SAML Authentication. so we decided to provision external users in our AD and have them sign in as windows.
    – Ronak
    Commented Jan 28, 2018 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.