Windows Auth and Forms with LDAP provider - merge identity?

Question

I have a need to handle two unique authentication scenarios:

• "Off network" - provide a login form (Forms based auth)
• "In Network" - traditional windows auth / no form

This is the same user base - all Active Directory users. I can do this in SharePoint easily by enabling multiple authentication providers - however, I've essentially created two identities that I need to maitain security on - for the same person.

Is there a way to "merge" the identity coming back from the LDAP provider so SharePoint treats it like the Windows Identity?

Any ideas would be great!

Answer 1

Out of the box no. You would need to create custom code or script that runs thru and captures your LDAP user permissions than assign those to the windows user.

Third party administrative products like Axceler ControlPoint and AvePoint DocAve, have this ability. While they are great tools, it's not very cost effective to deploy them for this single reason. Have a look at using a proxy like Microsoft Threat Management Gateway (or other that will support Kerberos constrained delegation)? You could use forms authentication with KCD, thus keeping all your users tied to AD objects.