Claim Based Authentication Error "The value is neither a claim user name nor a claim user name suffix"

Question

In my SharePoint farm, I have form based authentication enabled as well as Windows authentication. All works fine, but in some scenario, when I login, and hit the logout and try to login again at some intermittent time it gives an error for chrome browser for whole site as below.

So when I close the browser, I could open the site and login again without any issues.

Note: this error only appears for domain users. It doesn't occur for users which are registered inside database.

By checking the ULS logs, below is the details I am getting:

The value is neither a claim user name nor a claim user name suffix

System.InvalidOperationException: Operation is not valid due to the current state of the object. at Microsoft.SharePoint.Administration.Claims.SPClaimUserKeyUtility.GetUserKeyString(String value) at Microsoft.SharePoint.Utilities.SPUtility.GetFullUserKeyFromLoginName(String userNameSuffix) at Microsoft.SharePoint.ApplicationRuntime.SPHeaderManager.AddIsapiHeaders(HttpContext context, String encodedUrl, NameValueCollection headers) at Microsoft.SharePoint.ApplicationRuntime.SPRequestModule.PreRequestExecuteAppHandler(Object oSender, EventArgs ea) at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

I have not found any relevant solution yet. Can someone help, if encountered such issue before.

Thanks in advance.

Answer 1

I had the same issue today on a site with Kerberos authentication. It started after I extended the web app using Powershell. I saw the same errors in ULS logs as you mentioned. For some reason the authentication mode for this web app changed from Kerberos to NTLM and the web app got converted to Classic mode. I converted it back to Claims mode and enabled kerberos and its back up. The ULS error 'Neither a claims user nor a claims user suffix' suggested something was wrong with claims mode. Checked it by running this command and the output was false: $WebAppName = "http://" $wa = get-SPWebApplication $WebAppName $wa.UseClaimsAuthentication false Converted back to claims mode using this command: Convert-SPWebApplication -Identity yourWebAppUrl -To Claims -RetainPermissions [ -Force] Please check your web application's authentication provider settings. Reference: https://technet.microsoft.com/en-us/library/gg251985.aspx

Answer 2

Finally found a solution to this problem.

It was happening for me only in Chrome, once logged out for several times in a row it seems to lose the ability to translate windows credentials to claims.

Anyway, the solution is

• Go to Central Admin > Web Application > Authentication Providers
• The "Enable Windows Authentication" should be TICKED, but UNTICK the "Integrated Windows authentication" and it all starts working as intended, no issues with the forms or windows logins.

Works on my SharePoint 2019.

Answer 3

I had the same issue and, in my case, using Edge / Chrome was the problem.

On Internet Explorer I had no issues (http site).

My scenario:

• SP: SharePoint Subscription
• SQL: SQL Server 2019
• OS: Microsoft Windows Server 2022 Datacenter Azure Edition

Short reason: Cookie security.

Chrome/Edge requires flags being set on the cookies in order for them to continue to function cross-domain. Microsoft released patches to SharePoint to implement the flags – however the flags also require the cookie to be marked SECURE and now only allows the cookies to function with HTTPS/SSL.

Granted you should only be using FBA in production with SSL; however, it was convenient to not use it in dev/test environments. So, if you think you have FBA setup correctly but aren't able to login – this is most likely the problem. Setup the site to use SSL and it should start working.

If you have both windows authentication and forms authentication enabled on the same site and choose to authenticate with windows authentication – even that will no longer work without SSL enabled. You’ll get a "Sorry, Something Went Wrong" – "An unexpected error has occurred." error.

On SP logs you will get "The value is neither a claim username nor a claim username suffix"

After adding a SSL cert and create a new HTTPS binding on IIS, I was finally able to login on Chrome/Edge and IE using Windows or FBA.

My web.config details:

I've applied it to my CA, WEB Application and SecurityTokenServiceApplication.

 <connectionStrings>
<add name="ADConnectionString" connectionString="LDAP://MYDOMAIN.local/DC=MYDOMAIN,DC=local" />

<membership defaultProvider="i">
      <providers>
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=16.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
        <add name="ADMembership" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADConnectionString" enableSearchMethods="true" attributeMapUsername="sAMAccountName" />
      </providers>
    </membership>

My web application AP:

ps: Make sure you share your site collection (under your FBA Web application) with your FBA user account and your AD user account (*if you're also using windows authentication) otherwise, you will get "File not found" error or access denied error after login. You can set it on Application Manager > Change site collection administrators or Application Manager > Manage web applications . Select your web application then > User policy