Can people picker resolve NTLM users in an FBA extended site

Question

We have a SharePoint 2010 extranet web application that uses claims authentication. •The Intranet zone is using mixed authentication (NTLM against internal AD and FBA against a separate AD). •The Extranet uses FBA only against the separate AD.

We have sites that have NTLM users in the Members SharePoint group. We have librarys with "Person" colums limited to the Members group. We would like to allow FBA users to pick NTLM users that are in the Members group when fillng in item metadata. The problem is that the FBA users can see the NTLM users in the people picker but when they select them, the user is not resolved. I realize we could probably work around this by adding NTLM to the Extranet zone but prefer not to do this if possible.

My questions are:

Is this a scenario where a custom claims provider would be appropriate?

Is this a problem that could be resolved with the peoplepicker-searchadforests property? (I've not been able to get my head around a real world example where this property is in play)

Answer 1

All the PeoplePicker properties work with LDAP queries only. That means the PeoplePicker can not be configured to search specific SharePoint groups (like the Members group) as well. All you can do is limit the search to being SiteCollection users, like this:

stsadm -o setproperty 
–pn peoplepicker-Peopleeditoronlyresolvewithinsitecollection 
–pv yes 
–url http://myserver

stsadm -o setproperty 
–pn peoplepicker-onlysearchwithinsitecollection 
–pv yes –url http://myserver

It can however search only specific AD groups if you like:

stsadm.exe -o setproperty 
-url http://myserver 
-pn "peoplepicker-searchadcustomfilter" 
-pv "(memberOf=CN=SharePoint,OU=AccessGroups,DC=contoso,DC=local)"

Check this article for more information about the PeoplePicker: http://technet.microsoft.com/en-us/library/gg602075.aspx

Answer 2

You need to put the FBA configuration (web.config) in your Extended Web Application's web.config as well (which kind of negates the whole point of extending the Web App) in order for users on your internal AD to resolve users within the FBA AD.