1

we have a sharepoint 2016 on prem with an user profile connection configured for active directory. we have also an claim provider for ADFS for the same domain used in an extranet scenario. When we try to add the the 'synchronization connection' configured with the ADFS claim provider we get

Cannot insert duplicate key row in object 'dbo.ADImportDCMapping' with unique index 'IX_ADImportDcMapping_DCName'. The duplicate key value is (edited.local, DC=edited,DC=local). The statement has been terminated.

is it possible to add a second connection to the same domain with a different authentication provider? we have a similar setup on an sharepoint 2013 that gave us no issue and on the profile config database we see no rows, while in the sharepoint 2016 profile we effectively see one row.

we have also tried different contaner but the definition of the index IX_ADImportDcMapping_DCName prevent us from using the same domain.

many thanks

2 Answers 2

0

Do not do this.

You will produce (or can't :)) duplicate User Profiles. This breaks various OAuth scenarios. In addition, a user cannot have two identity providers and be considered the same identity. That is, if a user logs in with Windows Claims auth, their SAML identity will not be considered the same user when it comes to SharePoint permissions.

5
  • thanks for the info, but I'm missing something: i have 2 distinct profiles, one for the ADFS and the other for Windows. How can I retrieve the property for the user when i'm logged from ADFS in the extranet scenario? thanks again Commented Mar 27, 2019 at 15:51
  • I think that the right way to go is to setup MIM based on the following post: blogs.technet.microsoft.com/adamsorenson/2018/01/31/… Commented Mar 27, 2019 at 16:33
  • Again, do not do this. You do not want duplicate profiles. It will cause OAuth connections that rely on Profiles like to Workflow Manager to fail. Your user's permissions will also not be the same -- you would need to add a user to a permission with both Windows claims and SAML. Pick a single authentication method for all users and stick with it. Or use an AD FS non-claims relying party so you can continue to use Windows Claims.
    – user6024
    Commented Mar 27, 2019 at 17:07
  • do you suggest an approach similar to: helloitsliam.com/2015/10/18/sharepoint-and-adfs-claims? Commented Mar 27, 2019 at 18:37
  • I suggest not using SAML at all. Look into docs.microsoft.com/en-us/windows-server/identity/ad-fs/….
    – user6024
    Commented Mar 27, 2019 at 19:09
-1

thanks Trevor, you shed some light in a very obscure matter for me. I think that I've always integrate ADFS with sharepoint in the wrong way. time to review my whole idea on plan extranet access to sharepoint by ADFS.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.