We have a SharePoint 2010 extranet web application that uses claims authentication. •The Intranet zone is using mixed authentication (NTLM against internal AD and FBA against a separate AD). •The Extranet uses FBA only against the separate AD.

We have sites that have NTLM users in the Members SharePoint group. We have librarys with "Person" colums limited to the Members group. We would like to allow FBA users to pick NTLM users that are in the Members group when fillng in item metadata. The problem is that the FBA users can see the NTLM users in the people picker but when they select them, the user is not resolved. I realize we could probably work around this by adding NTLM to the Extranet zone but prefer not to do this if possible.

My questions are:

Is this a scenario where a custom claims provider would be appropriate?

Is this a problem that could be resolved with the peoplepicker-searchadforests property? (I've not been able to get my head around a real world example where this property is in play)

2 Answers 2


All the PeoplePicker properties work with LDAP queries only. That means the PeoplePicker can not be configured to search specific SharePoint groups (like the Members group) as well. All you can do is limit the search to being SiteCollection users, like this:

stsadm -o setproperty 
–pn peoplepicker-Peopleeditoronlyresolvewithinsitecollection 
–pv yes 
–url http://myserver

stsadm -o setproperty 
–pn peoplepicker-onlysearchwithinsitecollection 
–pv yes –url http://myserver

It can however search only specific AD groups if you like:

stsadm.exe -o setproperty 
-url http://myserver 
-pn "peoplepicker-searchadcustomfilter" 
-pv "(memberOf=CN=SharePoint,OU=AccessGroups,DC=contoso,DC=local)"

Check this article for more information about the PeoplePicker: http://technet.microsoft.com/en-us/library/gg602075.aspx

  • While that is true, you can limit a 'Person or Group' column to a particular SharePoint group. When you use the browse button on the metadata field, the people picker control will honor that filter. In this situation it appears that the picker can see the Members in the SharePoint group but cannot resolve them against Active Directory. Apr 12, 2012 at 15:43
  • No matter what constraint you add to your field regarding users/groups, the peoplepicker-searchadcustomfilter will still be used when trying to validate the user. If this filter is not correctly set up against your AD, you will be able to locate the user in peoplepicker but you will not get them to resolve. Do you manage to resolve the users in other places in the site? For example in the assigned-to field in the task list? Apr 13, 2012 at 15:07

You need to put the FBA configuration (web.config) in your Extended Web Application's web.config as well (which kind of negates the whole point of extending the Web App) in order for users on your internal AD to resolve users within the FBA AD.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.