Add FBA role to SharePoint 2010 group

Question

I've setup FBA for SharePoint 2010 following these instructions: http://blogs.msdn.com/b/kaevans/archive/2010/07/09/sql-server-provider-for-claims-based-authentication-in-sharepoint-2010.aspx

It mostly works with one issue: I can't add FBA roles to SharePoint groups from Site Actions -> Site Settings -> People and groups. Here's what works:

• In Central Admin add FBA user to web application's User Policy.
• In Central Admin add FBA role to web application's User Policy.
• In SharePoint Site Settings add FBA user to any SharePoint group for the site (Owners, Visitors, Members, etc.)

So it's just trying in SharePoint Site settings to add an FBA role to a SharePoint group that isn't working. For instance I want all FBA users that are in the FBAUsers role to be in the Visitors group for this site, but I can't add the FBAUsers role to the Visitors group. When I try it has the squiggly red underline and won't let me finish adding it.

Any tips on where/how to troubleshoot? I've retraced my steps, compared web.config settings with the instructions, and as far as I can tell I've followed it to the letter.

Answer 1

You are doing everything correctly, and I can confirm that with the proper setup you are able to add roles to SharePoint groups. If you are getting the red underline, then most likely it is an issue with your web.config files:

Make sure that the RoleManager web.config entry is in your:

• Application web.config
• Central Admin Web.config
• Secure Token Service web.config

Make sure that the default role manager in your web application's web.config is the SharePoint role manager (SPClaimsAuthRoleProvider).

Also make sure that your Role Manager Name for your SharePoint application (Central Admin - Web application Authentication Settings) matches your web.config.

Here is my entry for reference, you just need to change the name to match what you entered in your SharePoint application's Authentication Settings and change the connection name to match your membership provider's connection name.

<roleManager cacheRolesInCookie="false" defaultProvider="c" enabled="true">
  <providers>
    <add name="FBARoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" applicationName="/" connectionStringName="FBADB" />
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
  </providers>
</roleManager>

You can use the .Net Roles item in IIS to verify that the roles can be read. If you install the SharePoint 2010 FBA Pack (http://sharepoint2010fba.codeplex.com/) you can use the role manager it installs to validate the roles can be read.

Answer 2

After a lot of try-this-to-see-if-it-works troubleshooting, the problem was a SQL permissions issue.

The instructions at the link I mentioned in my original post says to give aspnet_Membership_BasicAccess and aspnet_Roles_BasicAccess roles to the account that the web application runs as, but when I gave that account those 2 roles as instructed it wasn't able to properly use People Picker to add roles. Further, the Lookup also didn't work for users (I could still add users by typing in the username then Check User button). Giving svcSPAppPool db_owner role on aspnetdb made everything work. It's probably overkill rights and I could make lesser rights work, but after days of troubleshooting at this point I'm content to leave it as is for now.

The author used Network Service for the web application account while I used a separate service account I created just for web applications (this is what I do on any typical SharePoint install) that I called svcSPAppPool. That probably had something to do with why adding the roles he mentioned didn't work for me. Further testing would prove/disprove this, but again I'm happy with how the setup is now so experimentation will have to wait another day.