We are trying to replicate our 2007 setup of FBA in SharePoint 2010.

Create a Web Application that is Windows login for internal users. Extend the Web Application that is for FBA login for external users.

I'm aware in SharePoint 2010 you can have both logins providers within the same web application, but the reason why we cannot do this is to do with SSL certificates and the internal users are unable to hit the external URL.

In the interal Web Application, if I set it up so that it uses both Windows and FBA providers, the people picker can easily find both windows and FBA members and roles. As soon as you turn off the FBA (Central Admin > Manage Web Applications > Authentication Providers > Internal Zone, and untick Enable Forms Based Authentication (FBA) ) you are unable to add external users or roles.

If all the configuration is set up in the Web.Config (e.g, connection strings, membership provider, role provider) of the Windows web Application why would it only find users from the FBA if the FBA is ticked in Central Admin? It worked in 2007. We also have the web.config changes in Central admin and STS.

We need this functionality so that Internal Windows are the sites owners, and will want to provide access for their external clients to their sites.

  • From the question I am assuming your internal zone is not accessible from the external zone,if it is so, why you are untick-ing the FBA for internal zone? Sep 6, 2012 at 8:02
  • Just confirming, but have you switched your web application to claims mode?
    – mhijazi
    Sep 6, 2012 at 12:55

1 Answer 1


I recently worked on a similar situation (in fact it was nearly identical).

You can not get the people picker to work without enabling both authentication methods. Now, this poses an issue for your users logging in to the site, as the average user won't know what to do about the OOTB drop down to choose your authentication method. For your external web application this is pretty straight forward. You enable both methods and then point the login page to the FBA login. This method doesn't quite work for NTLM authentication. In that case you need to create a custom login page to only authenticate using Windows NTLM authentication.

Even though you may have the appropriate values in the web.config file, the people picker won't pick this up unless both authentication methods are enabled on the web application.

Check out my two posts about this:

Central Administration, FBA, and the People Picker

NTLM Authenticated Application, FBA, and the People Picker

Alternatively, you can create an FBA login to administrate the FBA side of the site (permissions, groups, etc.), but this leaves a hole if there is a business need to use the people picker elsewhere (list with a person column, targeting emails, etc.).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.