0

We have webapplication extended to provided windows auth on one zone and SAML Auth using ADFS on second zone. We have SharePoint servers let's say on Contoso.com and users are Foo.com domain. This Foo.com domain has ADFS server configured for SAML authentication. My question is can i use same Foo.Com users for windows authentication meaning same domain users login using different authentication providers ? If yes , what should be direction of one way trust between domains ?

Please advise

Thanks, Ronak

Improve this question

1 Answer 1

Reset to default
0

No, you should never mix two forms of authentication for the same user as SharePoint will see them as two distinct objects; this can cause issue with apps that rely on the UPSA, such as Workflow Manager.

Improve this answer
3
  • Thanks Trevor. We are not using Workflow Manager or not planning to use in future. Do you think even SharePoint will allow to authenticate users from Foo.com ? I can't get it People picker to search users from foo.com.
    – Ronak
    Jan 28, 2018 at 13:56
  • Yes, if you have a one-way trust in place you can auth and use the People Picker. See thesharepointfarm.com/2014/01/… for details on how to set it up. But in this scenario, you would not use ADFS at all.
    – user6024
    Jan 28, 2018 at 17:10
  • Thanks Trevor. Yes we are in identity mess as of now. We need to do this Report Builder does not work with SAML Authentication. so we decided to provision external users in our AD and have them sign in as windows.
    – Ronak
    Jan 28, 2018 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.