One of my customers has a second Sharepoint farm installed in the extranet network with a dedicated domain. To allow internal users to login in the extranet Sharepoint, there is a one-way trust between internal domain and external domain.
I'm trying to add internal's users in a site collection of extranet's farm, but I got this error
$web = Get-SPWeb http://extranet/sites/sitecollection $web.EnsureUser("i:0#.w|internalDomain\userName") Exception calling "EnsureUser" with "1" argument(s): "The specified user i:0#.w|internalDomain\userName could not be found." At line:1 char:1 + $web.EnsureUser("i:0#.w|internalDomain\userName") + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) , MethodInvocationException + FullyQualifiedErrorId : SPException
EDIT Even if ensureUser doesn't work, the authentication process for that user works normally.If I grant collaboration permissions to group "all users authenticated", that user access to the home page.If that user adds an element to a list the field Author is empty
EDIT Thanks Marek Sarad, I have fixed it.
I run the powershell script for Sharepoint 2016 but it didn't work, it throws an error on the line
$newdomain1.SetPassword($credentials.Password) Exception calling "SetPassword" with "1" argument(s): "Cannot retrieve the information for application credential key."
To fix it, I run the command STSADM -o setapppassword -password myPassword then I had another problem. in the Sharepoint website, I installed a custom HTTP module that throws an error on SPWeb.EnsureUser
Application error when access UrlToDocument, Error=Requested registry access is not allowed. at System.ThrowHelper.ThrowSecurityException(ExceptionResource resource) at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable) …….. at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalInternal(SPWeb web, SPWebApplication webApp, Nullable`1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPUserCollection usersContainer, Boolean inputIsEmailOnly, Boolean alwaysAddWindowsResolver) at Microsoft.SharePoint.SPWeb.EnsureUser(String logonName) ……… at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
I used procmon.exe and I saw that the application pool user cannot access to the registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\Secure
because it haven't the permissions. I grant that account to read that registry key. what do you think about it? do you suggest to change the code of the http module to use some magic c# feature to impersonate an administrator security context?