Sharepoint 2019 - Adfs and NTLM - strange behaviour

Question

We have a SharePoint 2019 on premise installation. We use ADF authentication to provide federate auth. To keep search working we also have NTLM enabled.

On our main web application, we have two zone, a default zone with NTLM only enable and an intranet zone with ADFS only enable. the default zone bind on http://oursite.ourdomain:8080 and the intranet bind on https://oursite.ourdomain:443. We also use ldapcp for peoplepicker for the intranet zone.

It's in production and work but we've got strange behaviors and missing feature. Bug:

• Upload size limit is 54MB on the intranet zone even if I change configuration on SharePoint or on IIS (web.config). On the default zone, the limit respect what I set up.
• If I use URL link share when I share something, the enrolling URL use the default zone URL

Missing Feature:

• We can't use SharePoint app or OneDrive client.

I've got some questions:

• Any ideas of this bugs?
• should I use only one zone and use SPBypasslogin to hide NTLM (and from peoplepicker?)
• Should I modify my architecture and put a WAP in front end?

Answer 1

WAP + non-claims aware relying party with KCD configured on SharePoint would be the route I'd take. You can then eliminate LDAPCP. You will need to migrate your users (Move-SPUser) if you make this change, though.

You will not be able to use the SharePoint App nor OneDrive client as they do not support forms-based auth for on-prem.