1

I have been asked to configure ADFS on SP 2016 on-premise. I am trying to configure SharePoint to use ADFS authentication.

I followed the steps on technet article and configured it. But I don't understand how to use it to be honest. The login page asks which way I should get in, and the browser I use seems to keep this info for future logins. I realised that when I sign in via adfs or Windows authentication, although I am going with same account, it's 2 completely different experiences. Is this normal?

For instance, when I sign in with ADFS my username is myaccount@organisationemail.co.uk and by Windows it shows First name last name as normal. I tried to create a personal view on one of them and the other one cannot see it. This made me panic as this is absolutely something I don't want the users to experience.

So please, can someone tell me how to cope with this? Is there a way to by pass that login page and ensure that users only login with ADFS route? The technical documentation only tells until you configure it..Not afterwards.(The usual joys of Technet) So kind of stuck!

Thanks in advance for any advices.

Improve this question
4
  • ADFS is a very generic tool which can be configured to many needs. You didn't specify what you are trying to achieve with your config. Please add this to your question so we can try to help.
    – MHeld
    Mar 12, 2018 at 12:03
  • We need the users to be authenticated by ADFS. - just added that.
    – ova
    Mar 12, 2018 at 12:20
  • ADFS is always about authenticating users :-) So this answer is not helpful. I will add an answer about the most-used scenarios in SharePoint. Select the one for your needs.
    – MHeld
    Mar 12, 2018 at 16:45
  • 1
    thanks everyone for all the comments. We have decided to drop ADFS and use externally Azure AD & internal kerberos- reason is simple. Too many problems with people picker. Thanks.
    – ova
    Apr 4, 2018 at 11:49

2 Answers 2

Reset to default
4

you actually have two different options of using ADFS for authN.

  1. You can use ADFS and WAP, where WAP is domain joined and you can use Windows AuthN.

  2. You can use ADFS and WAP where WAP is not domain joind and you can configure SharePoint to use SAML. If you go down this path you also need to be aware of the downsides to this as resolving users in people picker, search,...

I wrote some articles on this: Xblogs | All posts by robi http://xblogs.kompas-xnet.si/author/robi

Hope this helps

Improve this answer
2
  • Hi Roberto! Which drawbacks have you Seen in search when Working with SAML-Auth? Thanks! Matt
    – MHeld
    Mar 12, 2018 at 21:21
  • 1
    Hi Matt, not really drawbacks but you need to be aware of limitations that SharePoint has. So SharePoint Search does not know how to authenticate to SAML based web app, so you need to have your default zone set up as Windows and then you can extend it and use SAML. Search needs to crawl your default zone with Window auth.
    – R0b3r70
    Mar 12, 2018 at 22:43
3

As described in comments, here are some common scenarios for SharePoint and ADFS. Is yours included?

Improve this answer
3
  • I think it's this one for us: Use Azure AD as an Identity Provider with ADFS for SharePoint but the person who does the actual ADFS side config is off this week! So I have to wait until he gets back. Or try and find someone who knows. thanks so much for sharing this!
    – ova
    Mar 13, 2018 at 12:41
  • I'm also being very disappointed about how the people picker misbehaves in this scenarios. And the lack of MS documentation for on premise scenarios!
    – ova
    Mar 26, 2018 at 9:04
  • There are Lots of drawbacks with any TrustedIdentityProviders in SharePoint. For this reason i prefer a local AD Account also for external Users and publishing via ADFS&WAP with Kerberos or via Azure AD Application Proxy. OnPremise WAP with Kerberos is Not the Most Secure way, but it has low technical limitations with an acceptable Security Level. AADProxy is the best you can do today, but it‘s Not that cheap.
    – MHeld
    Mar 26, 2018 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.