0

We currently have two domains in our environment, lets say DomainA and DomainB. Users have IDs in both domains. Userids in DomainA have been given access to our new SharePoint 2016 environment. The site is in the intranet zone in the browser.

If a user is logged into his environment with his DomainB login and navigates to the sharepoint site he gets the Access Denied page.

I need to enable the user to enter credentials and log in with his DomainA id. Is there a way to add a 'Log in as different user' functionality to the AccessDenied.aspx.

1

In short, no you shouldn't implement any log in as another user functionality as this does not properly clear the session in SharePoint 2013+.

What I would suggest doing is make sure you're using an FQDN (https://sharepoint.contoso.com, for example) and do not put either sharepoint.contoso.com or *.contoso.com in an IE zone (Intranet by default, or Trusted with 'automatically login with current credentials). This will force the browser and Office client to prompt for credentials each time -- users will likely not appreciate this, of course.

The other option would be to implement a form of pre-authentication reverse proxy. Web Application Proxy and AD FS can be used for this purpose. With AD FS you can implement a non-claims aware relying party to prevent the need to use SAML on SharePoint. I do not recommend converting to SAML due to various user experience issues in SharePoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.