0

I'm facing a problem with my forms authentication that has consumed me some good hours.

My forms authentication points to 2 providers. Both are AD using a ldap connection to diferent domains.

I have the following provider configuration on my web.config

<membership defaultProvider="AD">
  <providers>
    <add name="AD" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADService" connectionUsername="domain1\Admin" connectionPassword="Password" connectionProtection="None" attributeMapUsername="sAMAccountName" enableSearchMethods="true" />
    <add name="AD2" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="ADTeste" connectionUsername="domain2\Admin" connectionPassword="Password123" connectionProtection="None" attributeMapUsername="sAMAccountName" enableSearchMethods="true" />
  </providers>
</membership>

PeoplePicker is unable to find users from the second connection. I already added the provider, but still have the problem. Does anyone have an idea what i'm missing ?

Here follows my on web.config

<PeoplePickerWildcards>
  <clear />      
  <add key="AD" value="%" />
  <add key="AD2" value="%" />
</PeoplePickerWildcards>
Improve this question
2
  • Do you have both of your connection strings in place?
    – RJ Cuthbertson
    Commented Sep 25, 2012 at 14:03
  • My connection strings can be found below the </SharePoint> tag. They were tested by my custom login page, which uses the connection string to autenticate the users Follow the cs: <connectionStrings> <add name="ADService" connectionString="LDAP://Domain1.org.br/DC=Domain1,DC=org,DC=br" /> <add name="ADTESTE" connectionString="LDAP://Domain2.org.br/DC=Domain2,DC=org,DC=br" /> </connectionStrings>
    – Pablo Bertrão
    Commented Sep 25, 2012 at 17:47

3 Answers 3

Reset to default
1

Just solved the problem.

My SharePoint farm is installed on domain which provider AD points to. I did the following steps to solve it:

1º Change the default provider in the original web application to AD2.

2º On the extended web app, I changed the default provider to AD.

Now, peoplepicker is able to find the users from both domains.

Thank you for all the comments

Improve this answer
0

You would need to add that connection string in 3 places on your farm (beware of multiple WFE as these manual changes require manual input in all WFE!) - Central Administration, Web Services and your target Web Application for this to work properly!

Improve this answer
6
  • 1
    To be a tad more precise: web.config of your web application, web.config of your central administration site and web.config of your STS service. I also assume you're using claims based authentication? Please add your connectionstring config as well, I notice your config says "ADTeste" as name, which seems weird.
    – Jasper
    Commented Sep 25, 2012 at 14:20
  • I'm using moss 2007. I forgot to add the connection strings on my SSP. Tried to add it on ssp wb.config, but still not working. The connection strings: <connectionStrings> <add name="ADService" connectionString="LDAP://Domain1.org.br/DC=Domain1,DC=org,DC=br" /> <add name="ADTESTE" connectionString="LDAP://Domain2.org.br/DC=Domain2,DC=org,DC=br" /> </connectionStrings>
    – Pablo Bertrão
    Commented Sep 25, 2012 at 14:35
  • ahh...you should have mentioned that as equation changes, but still you need to keep your web.config on CA and Web-App at least!
    – Marius Constantinescu
    Commented Sep 25, 2012 at 15:05
  • I did it, still not working. I can log on in my site with a user from Domain2, but it has no permission, since i'm unable give permissions using peoplepicker.
    – Pablo Bertrão
    Commented Sep 25, 2012 at 16:30
  • Make sure the case of your connection string name is the same. ADTESTE != ADTeste
    – RJ Cuthbertson
    Commented Sep 25, 2012 at 17:58
0

For LDAP providers, the search character is "*", not "%". Is there a reason you're not using Microsoft.Office.Server.Security.LdapMembershipProvider? Here is the way the web.configs are supposed to be configured: http://technet.microsoft.com/en-us/library/cc197251(v=office.12).aspx.

Improve this answer
2
  • I've followed this post devx.com/enterprise/Article/35068 to configure my FBA. I will change the web.config as you mentioned and check for differences.
    – Pablo Bertrão
    Commented Sep 25, 2012 at 18:42
  • I changed the web.config file using the site you mentioned. I still have the same problem, peoplepicker can find users from domain1 but not domain2. Also, my custom login page cannot authenticate more the users from both domains. Dont i have to inform web.config the connection string user and password for domain?
    – Pablo Bertrão
    Commented Sep 26, 2012 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.