Is there a good alternative to SPUtility.ResolvePrincipal for claims?

I have a situation where I have users' email addresses, and I need to get their login names so I can call SPWeb.EnsureUser. Since switching to claims, ResolvePrincipal only works if the people have already been added to the site users list, and I need it to specifically work if they have not already been added there, because the whole point is to call EnsureUser to make sure anyone who has not been added yet is added.

I found a blog post that shows how to make a claim-like string using SPClaimProviderManager.CreateUserClaim, but if I use their email address in that, it creates a claim like i:0e.t|issuer|[email protected] which fails on EnsureUser because our real claims are more like i:0e.t|issuer|[email protected].

I've found that I can call EnsureUser with the email address and not the login name, but then it creates a user account with the login/claim like c:05.t|issuer|[email protected] which ends up not actually matching people's real accounts.

How can I get the correct, proper claim to use in EnsureUser if all I have to work with is an email address?

1 Answer 1


Ok, finally figure out a good workaround. Keep in mind my end goal is to be able to identify users (using only their email address) that have not been added to a site yet, so that I can call EnsureUser and ensure that they are then added to the site.

Since in my case SPUtility.ResolvePrincipal got cut off from its access to AD, I had to reach out to AD directly through the System.DisrectoryServices.AccountManagement namespace. Then once I have the user principal from AD, I have to construct a correctly formatted claim based on the user's UPN to be able to pass that to EnsureUser.

// in addition to other usings, you definitely need these...

using Microsoft.SharePoint.Administration.Claims;
using Microsoft.SharePoint.Utilities;
using System.DirectoryServices.AccountManagement;

SPUser spUser = null;
SPPrincipalInfo spUserPrincipal = null;

spUserPrincipal = SPUtility.ResolvePrincipal(elevatedWeb, email, SPPrincipalType.User, SPPrincipalSource.All, null, true);

if (spUserPrincipal != null)
    // EnsureUser is a bit redundant here because ResolvePrincipal will only have worked if
    // the user is already added to the site users list, but in the end
    // i need an SPUser object, so might as well...

    spUser = elevatedWeb.EnsureUser(spUserPrincipal.LoginName);
    // ResolvePrincipal didn't work, so we know we need to grab the user directly from AD

    string samlClaim = null;

    using (PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "DOMAINNAME"))
        // set up a user principal with parameters to search by,
        // namely, email address.  making sure it's enabled is also
        // probably a good thing to check for

        UserPrincipal searchPrincipal = new UserPrincipal(ctx);
        searchPrincipal.EmailAddress = email;
        searchPrincipal.Enabled = true;

        PrincipalSearcher searcher = new PrincipalSearcher(searchPrincipal);
        Principal adPrincipal = searcher.FindOne();
        if (adPrincipal != null)
            SPClaimProviderDefinition claimProviderDef = SPClaimProviderManager.Local.GetClaimProvider("LDAPCP");
            string issuerIdentifier = claimProviderDef.ClaimProvider.GetLocalizedDisplayName();

            // build the claim token / string to use later

            samlClaim = SPClaimProviderManager.CreateUserClaim(adPrincipal.UserPrincipalName, SPOriginalIssuerType.TrustedProvider, issuerIdentifier).ToEncodedString().ToLower();
            // didn't find an account in AD with the specified email (at least, not one that's active)

    if (!string.IsNullOrWhiteSpace(samlClaim))
        // call EnsureUser with the correctly constructed claim
        // to then add the user to the site

        spUser = elevatedWeb.EnsureUser(samlClaim);
        // must not have found the user account based on email, so therefore
        // couldn't construct the claim, and with no claim, can't call EnsureUser

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.