7

Problem:

When selecting an user in the peoplepicker, and posting the page to the server, an error is returned that the user cannot be found (No exact match was found). This happens when a task is to be assigned to a user that is not known in the site, or when trying to add a new user to the site.

Situation:

  • Users are authenticated using NTLM
  • A 1-way trust is used, to allow users from the trusted domain to be picked peoplepicker-searchadforests has been configured (before this was configured users from the trusted AD could not be found at all, after the configuration the users from the trusted AD can be found, but the above described error occurs)
  • An account from the trusted domain is used to perform the query.
  • When using ADExplorer (from Sysinternals) from the SharePoint server with the account from the trusted domain, the trusted domain can be browsed without any problems.
  • This error occurs on 2 separate test farms
  • User profile service is present, but no user profile import has been configured.

Hints from ULS and windows events:

  • In the ULS the following verbose message is logged upon the post back: Exception when search SID "0x010....." from AD "{domain}.nl". Exception=Logon failure: unknown user name or bad password. The odd thing is that just a few moments later another Search FromGC is performed with the same SID only now to the AD "{domain}" (without the .nl!), and then it returns a count of 1.
  • When looking in the windows event around the moment that the error occurs, the following warning is logged: The Security System could not establish a secured connection with the server ldap/{server}.{domain}.nl/{domain}.nl@{domain}.NL. No authentication protocol was available.
  • When connecting to {server}.{domain}.nl with ADExplorer this gives no errors
Improve this question

2 Answers 2

Reset to default
2

There is an additional step of setting permissions on a registry key (if you have your accounts set up a certain way, i.e. not everything is running a the farm account, etc).

The keys are mentioned here:

Link

and the specific step is pasted below for convenience:

Set permissions on the Secure registry key on EVERY machine in the farm, granting the local WSS_WPG read access

  1. Open Registry Editor Navigate to : HKEY_Local_Machine\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\14.0\Secure
  2. Right-click Secure, select Permissions 3.Click Add 4.Find the local WSS_WPG group
  3. Select Read access
  4. Click OK out ofthe dialogs
Improve this answer
0

Just sanity checking this you have run the stsadm setproperty command already? I guess you may have because the people picker is returning results, but just in case you have not look at this post http://blog.hompus.nl/2010/06/01/using-the-people-picker-over-a-one-way-trust/

stsadm -o setproperty -url -pn peoplepicker-searchadforests -pv forest:;domain:,\,

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.