We have a SharePoint 2019 on premise installation. We use ADF authentication to provide federate auth. To keep search working we also have NTLM enabled.

On our main web application, we have two zone, a default zone with NTLM only enable and an intranet zone with ADFS only enable. the default zone bind on http://oursite.ourdomain:8080 and the intranet bind on https://oursite.ourdomain:443. We also use ldapcp for peoplepicker for the intranet zone.

It's in production and work but we've got strange behaviors and missing feature. Bug:

  • Upload size limit is 54MB on the intranet zone even if I change configuration on SharePoint or on IIS (web.config). On the default zone, the limit respect what I set up.
  • If I use URL link share when I share something, the enrolling URL use the default zone URL

Missing Feature:

  • We can't use SharePoint app or OneDrive client.

I've got some questions:

  • Any ideas of this bugs?
  • should I use only one zone and use SPBypasslogin to hide NTLM (and from peoplepicker?)
  • Should I modify my architecture and put a WAP in front end?

1 Answer 1


WAP + non-claims aware relying party with KCD configured on SharePoint would be the route I'd take. You can then eliminate LDAPCP. You will need to migrate your users (Move-SPUser) if you make this change, though.

You will not be able to use the SharePoint App nor OneDrive client as they do not support forms-based auth for on-prem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.