3

We are using SharePoint 2016 and ADFS 2016. I have a situation that userX requested permissions to siteA. We are using the OOTB request access approval functionality. The approver received an email and approved the request. userX received an email that he has access to siteA but when he clicks on the hyperlink he still received an access denied. I can see userX in the OOTB contributor group. When I try to add userX manual in the contributor group I see a second user "userX" in this group. When I click on the latest one I will be redirected to the mysite of userX. When I click on the older userX I see the detail view of a list item.

Why I see 2 differant accounts in this SharePoint group? Is one from ADFS and the other from somewhere else?

UPDATE

In the people picker everything is working fine. When I search for a user it shows the email address and is unique. There are no duplicate users. When I give a user permissions it works fine.

See below the people picker:

enter image description here

See below the "request access" list with the wrong user (NTLM account):

enter image description here

UPDATE 2

I try to figure out to get the detail info of both user accounts by running this rest service: https://projects.mycompany.com/p/172/_api/web/siteusers

I see now this detail info below. It looks like one is a windows account, and the other one is from ADFS. Why SharePoint "Request Access" is using the windows account when someone requests access on a site?

enter image description here

UPDATE 3

It looks like I have the same issue as this forum post:

https://social.technet.microsoft.com/Forums/en-US/0c89c40c-e24b-436e-b4e2-d9a1387be3ca/sharepoint-2016-adfs-access-request-account-is-not-the-adfs-one-but-the-windows-account?forum=sharepointgeneral

  • do you have a custom claims provider? what authentication configured on the Web app level, ADFS & ntlm? in which zone which authenticaiton? what is the user id looks like in both user's cases? – Waqas Sarwar MVP Oct 9 '18 at 15:25
  • Could be if you also allow windows auth for the user to sign in... You should only have one user with same mail (unique!!!), or you will have fun with workflows later on – Heiko Hatzfeld_MSFT Oct 9 '18 at 16:34
  • Please see my update – Ola Oct 12 '18 at 8:05
2

With multiple authentication methods, SharePoint treats the same user as two different identities (Windows and SAML, in your particular case).

You need to settle on a single identity model for the entire farm, including the User Profile Service. This may mean you need to extend the Web Application to another zone to prevent users from adding Windows accounts and only allow SAML on that zone.

With that said, avoid SAML if possible. Using ADFS v4 (included in 2016), you can create a non-claims aware relying party which will allow you to continue to use Windows authentication against SharePoint while having the benefits of SSO.

SAML is also not compatible with the Cloud Search Service Application, should you go down the hybrid route in the future.

  • Please see my update – Ola Oct 12 '18 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.