SharePoint People Picker look-up for asp net membership provider not working

Question

We are trying to replicate our 2007 setup of FBA in SharePoint 2010.

Create a Web Application that is Windows login for internal users. Extend the Web Application that is for FBA login for external users.

I'm aware in SharePoint 2010 you can have both logins providers within the same web application, but the reason why we cannot do this is to do with SSL certificates and the internal users are unable to hit the external URL.

In the interal Web Application, if I set it up so that it uses both Windows and FBA providers, the people picker can easily find both windows and FBA members and roles. As soon as you turn off the FBA (Central Admin > Manage Web Applications > Authentication Providers > Internal Zone, and untick Enable Forms Based Authentication (FBA) ) you are unable to add external users or roles.

If all the configuration is set up in the Web.Config (e.g, connection strings, membership provider, role provider) of the Windows web Application why would it only find users from the FBA if the FBA is ticked in Central Admin? It worked in 2007. We also have the web.config changes in Central admin and STS.

We need this functionality so that Internal Windows are the sites owners, and will want to provide access for their external clients to their sites.

Answer 1

I recently worked on a similar situation (in fact it was nearly identical).

You can not get the people picker to work without enabling both authentication methods. Now, this poses an issue for your users logging in to the site, as the average user won't know what to do about the OOTB drop down to choose your authentication method. For your external web application this is pretty straight forward. You enable both methods and then point the login page to the FBA login. This method doesn't quite work for NTLM authentication. In that case you need to create a custom login page to only authenticate using Windows NTLM authentication.

Even though you may have the appropriate values in the web.config file, the people picker won't pick this up unless both authentication methods are enabled on the web application.

Check out my two posts about this:

Central Administration, FBA, and the People Picker

NTLM Authenticated Application, FBA, and the People Picker

Alternatively, you can create an FBA login to administrate the FBA side of the site (permissions, groups, etc.), but this leaves a hole if there is a business need to use the people picker elsewhere (list with a person column, targeting emails, etc.).