EnsureUser - The specified user could not be found

Question

One of my customers has a second Sharepoint farm installed in the extranet network with a dedicated domain. To allow internal users to login in the extranet Sharepoint, there is a one-way trust between internal domain and external domain.

I'm trying to add internal's users in a site collection of extranet's farm, but I got this error

Powershell

$web = Get-SPWeb http://extranet/sites/sitecollection
$web.EnsureUser("i:0#.w|internalDomain\userName")

Exception calling "EnsureUser" with "1" argument(s): "The specified user i:0#.w|internalDomain\userName could not be found."
At line:1 char:1
+ $web.EnsureUser("i:0#.w|internalDomain\userName")
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : SPException

EDIT Even if ensureUser doesn't work, the authentication process for that user works normally.If I grant collaboration permissions to group "all users authenticated", that user access to the home page.If that user adds an element to a list the field Author is empty

EDIT Thanks Marek Sarad, I have fixed it.

I run the powershell script for Sharepoint 2016 but it didn't work, it throws an error on the line

$newdomain1.SetPassword($credentials.Password)
Exception calling "SetPassword" with "1" argument(s): "Cannot retrieve the information for application credential key."

To fix it, I run the command STSADM -o setapppassword -password myPassword then I had another problem. in the Sharepoint website, I installed a custom HTTP module that throws an error on SPWeb.EnsureUser

Application error when access UrlToDocument, Error=Requested registry access is not allowed.  
 at System.ThrowHelper.ThrowSecurityException(ExceptionResource resource)    
 at Microsoft.Win32.RegistryKey.OpenSubKey(String name, Boolean writable)    
……..
 at Microsoft.SharePoint.Utilities.SPUtility.ResolvePrincipalInternal(SPWeb web, SPWebApplication webApp, Nullable`1 urlZone, String input, SPPrincipalType scopes, SPPrincipalSource sources, SPUserCollection usersContainer, Boolean inputIsEmailOnly, Boolean alwaysAddWindowsResolver)    
 at Microsoft.SharePoint.SPWeb.EnsureUser(String logonName)    
………
 at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()    
 at System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step)    
 at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)

I used procmon.exe and I saw that the application pool user cannot access to the registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0\Secure

because it haven't the permissions. I grant that account to read that registry key. what do you think about it? do you suggest to change the code of the http module to use some magic c# feature to impersonate an administrator security context?

Answer 1

Can you add users using people picker from the UI? If not probably you haven't configured it properly. In a one way scenario you need to run specific command:

stsadm -o setproperty -url http://<server:port> -pn peoplepicker-searchadforests -pv "forest:contoso.corp.com, contoso\<account>, <Password>;domain:bar.contoso.corp.com, contoso\<account>, <Password>"

REF: https://support.microsoft.com/en-us/help/2384424/sharepoint-people-picker-stops-resolving-users-from-other-domains-with

or PS version if you are on SP2016: https://blogs.msdn.microsoft.com/odabasi/2015/10/22/configuring-people-picker-in-a-one-way-trust-environment-with-powershell/