On the Windows Authenticated side of an extended web application with FBA, the people picker is only working when I also enable FBA through Central Administration for the Windows Authenticated web application.

When I enable FBA on the web application like so:

Edit Authentication Window

The people picker will pick up the FBA users without a problem. However, with both modes of authentication enabled, when you navigate to the Windows Authenticated site, you get a dropdown to choose your method of authentication rather than having the Windows credentials passed through:

Authentication Dropdown

Disabling FBA in the Edit Authentication modal allows the credentials to pass through, but you can not select FBA users in the people picker.

It's interesting to note that switching FBA on or off here has no effect on the web.config file.

Relevant web.config is set up as such:

  <clear />
  <add key="AspNetSqlMembershipProvider" value="%" />
  <add key="FBAMembershipProvider" value="%" />

<membership defaultProvider="i">
    <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="FBAMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" applicationName="/" connectionStringName="FBADB" enablePasswordReset="true" enablePasswordRetrieval="false" passwordFormat="Hashed" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" />
<roleManager cacheRolesInCookie="false" defaultProvider="c" enabled="true">
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
    <add name="FBARoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" applicationName="/" connectionStringName="FBADB" />

  <add connectionString="Blah Blah Blah - This Works" name="FBADB" />

The question is, how can I get the people picker to work without prompting the user to choose an authentication method at the time of login?

  • Was there a question? I'm guessing you want to know how to enable FBA, not be prompted for authentication method (trying NTLM first), and have the PeoplePicker work for FBA users?
    – shufler
    Aug 24, 2012 at 18:01

3 Answers 3


You may also notice that on the "real" FBA zone, if Windows Authentication is disabled, the People Picker won't show AD users either. So you're correct that in order to pick users from the underlying repository, authentication for that repository must be enabled.

You can try using http://spautomaticsignin.codeplex.com/ if you want to automatically sign in with Windows Auth on the internal zone (even if FBA is enabled).

The and sections of the web.config files are never modified by SharePoint when you enabled or disable FBA, and you always have to do those modifications yourself. You're also correct that the FBA settings in web.config don't have any impact if FBA authentication is not enabled on that zone.


For posterity, I resolved this in the following manner:

Captured network traffic with the developer tools and watched for the URL to the login page (which is different for either form of authentication)

In Central Administration > Manage Web Applications > clicking Authentication Providers in the ribbon presents the Edit Authentication dialog as seen in OP.

Scroll to the bottom of the Edit Authentication modal dialog to the section titled "Sign In Page URL" and select "Custom Sign In Page."

For the FBA authenticated extended web application use /_forms/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx%3fSource%3d%252F&Source=%2F

I had to create a custom login page for the NTLM authenticated web application, as using this same method to redirect to /_windows/default.aspx?... is inconsistent and breaks sign out. It only authenticates about 50% of the time, and throws an error the other 50%. I didn't figure out what the cause was, but the error generated is a NullReferenceException in the method SPClaimProviderManager.DecodeClaimFromFormsSuffix().

After creating the custom NTLM login, I set the "Custom Sign In Page" to my new custom page.

This will cause the appropriate login page for the chosen authentication method for each web application to default to the appropriate page.


I used this blog to write my custom login page: http://blog.octavie.nl/index.php/2012/06/11/custom-sign-in-and-sign-out-page/

Hope this helps someone.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.