0

I have successfully configured ADFS Authentication in SharePoint but unable to grant rights to users on ADFS based Site.

There are two zones in my Site:

Default: which is there to Enable Windows Authentication in order to enable crawler http://az-spfe-uat:27822/

Intranet: which is using ADFS Authentication and I have disabled Windows Authentication in order to Land the user directly to the ADFS Login Page.

If I grant rights to "Everyone", the site is accessible to all Employees.

But when I try to grant rights to specific user, I am unable to do so. When I go to Grant rights, there are two options coming for the same user in the People Picker:

username/adfs Role

username adfs EmailAddress

enter image description here

enter image description here

There is no Active Directory user visible

when I grant rights to above two users, the user is unable to access the Site.

Please Help

Improve this question
1
  • Is there anything inside SharePoint logs for any error messages related to the authentication process?
    – Pradip R.
    Commented May 11, 2023 at 12:04

1 Answer 1

Reset to default
0

In ADFS authentication, the people picker doesn't validate the input, it just shows you all the claim types available.
To be able to grant rights, you should type the exact full claim string (like i:05.t|adfs|[email protected]) and make sure that the Account field in the User properties is exactly in this form (where adfs is the name of your trusted identity token issuer in SharePoint). But it is make people picker kinda unusable this way.

So, it is better to install and configure custom claims provider like LDAPCP (of course if your SharePoint Server has network access to your users' Active Directory domain).

Improve this answer
5
  • If I grant rights using i:05.t|adfs|[email protected], what can I use to provide rights to Active Directory Groups? can you suggest.
    – Alina Anjum
    Commented May 15, 2023 at 10:20
  • It depends of how you've configured your role claim issuance policy in ADFS. Usually it takes a format of c:0-.t|adfs|groupname (if you've chosen Token-Groups - Unqualified Names). BTW, adfs is the name of your trusted identity token issuer in SharePoint. P.S. Seriously, it is better to use LDAPCP than doing this claim-perversions manually )
    – lehuspohus
    Commented May 15, 2023 at 16:28
  • Hi, you saved my Life! Thanks a lot. I have successfully configured LDAPCP & it worked fine!
    – Alina Anjum
    Commented May 16, 2023 at 13:01
  • Glad to hear it!
    – lehuspohus
    Commented May 16, 2023 at 15:03
  • can you help answering this: stackoverflow.com/questions/77457975/…
    – Alina Anjum
    Commented Nov 10, 2023 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.