6

I've configured 2 zones in sharepoint 2013. Both zones are configured to use NTLM and FBA authentication in order to have full availability of all users in the people picker.

My extranet zone (FBA) has custom sign in page set to /_forms/default.aspx... which works a treat with both fba login and people picker behaving as required. Configuring my intranet zone (NTLM) to use the default NTLM login URL /_windows/default.aspx... causes it to return an application runtime error. I understand that if I create a custom login page for NTLM I should be able to present my intranet users with transparent login. Is there anyone able to provide pointers on how to set up a custom page for NTLM?

I've found this post (http://tomaszrabinski.pl/wordpress/2011/06/23/sharepoint-2010-custom-login-page/) which is exactly what I need but have been unable to implement it for SP2013. Any help would be greatly appreciated. I'm not a coder but have given it a go in vs2013 using zavaz code. Changed the identity model reference and got the solution deployed to my test site butt getting server block errors etc. Gonna keep working through it. If I eventually get sorted I'll post my findings.

2
  • Further researched uncovered this ( spautomaticsignin.codeplex.com ) solution for Sharepoint 2010. However I want to authenticate all users transparently via ntlm. Limiting via ip is a little overkill for my scenario but could work. I may give this a go even though it may not be compatible in 2013.
    – Joss_24
    Feb 5, 2013 at 18:36
  • have you got any solution for this? I am also using mixed mode but not happy the way SP asks users windows authentication or Forms based authentication. is there any way I could login into Sharepoint from an API if I know user is in SQL profile or in active directory?
    – user15404
    Mar 7, 2013 at 17:42

2 Answers 2

6

I had the same problem when creating my custom login page, and the answer was to add the "/_layouts" to the front of the path I was linking to.


Creating a Simple Shared Login Screen

If you want some form of shared login screen, without needing the IP address or a feature or anything else, here's what I did to get that:

  1. For each site involved, created a new copy of the FBA login folder in LAYOUTS. These folders can then be modified per site and used as the custom login page for that site. (see example)

  2. On my custom login screens, I added a link such as "Employee Login" that points to the NTLM login page (/_layouts/windows/default.aspx)

  3. Had a policy pushed out so that all company machines had the site domains added to their 'Trusted Sites' zone in the browser

The end result is that everyone gets the same login screen. FBA accounts can enter their information normally, and AD users can click the "Employee Login" link to authenticate via NTLM. With the site being trusted, the browser passes their Windows credentials so they log right in with no prompt.


Example of Creating the Custom Login Folder/Page

It's been a couple of years but coming back to this question I thought I'd add the examples from the comments in case those get removed at some point.

Here are the steps & paths involved in creating that custom login page:

  1. Access your SharePoint server(s). Any WFE or Application server will do, as long as you make the same changes on any WFE serving content to users in the farm.
  2. Make a copy of folder "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\IDENTITYMODEL\FORMS". This is what your webapp uses when accessing the virtual "_forms" directory.
  3. Paste that folder into "C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS". This is the location of the virtual "_layouts" directory.
  4. Change the name of your pasted folder to something else (i.e. - "CustomLogin" instead of "FORMS". This name will be used in the URL for your new login page.
  5. If customizing the login page in SharePoint Designer or NotePad++ (or whatever your preferred editor is), you'll also want to look for a line like the one shown below. This is the master page reference. Copy the referenced file into your custom folder and update the referenced path accordingly.

Page Language="C#" Inherits="Microsoft.SharePoint.IdentityModel.Pages.FormsSignInPage" MasterPageFile="~/_layouts/15/errorv15.master"

  1. Once you've copied the master page and updated that reference, look further down the page code and you'll see the username/password fields for claims credentials. The two fields will have "SharePoint:EncodedLiteral" in them. The login button is a standard ASP-style button following the password. In this example, we're adding an "Employee Login" link right under that for our internal users.

  2. Beneath the existing login button, add a new row containing a link like so. Alternatively, you can add a button that changes the HREF location when clicked. The button looks a little nicer.

href="http://mysite.server.com/_windows/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx">Employee Login

  1. Save the page and test it in your browser by manually entering the new custom URL and page name. Confirm it looks ok and that both logins work.
  2. Update the default login page for your authentication provider, pointing it to the new custom page URL you just tested in your browser.
  3. If needed, copy the new custom folder to the LAYOUTS location on each server in the farm and/or serving content for the site.

Note: This example is using SharePoint 2013 on an Enterprise farm setup.


The Importance of Customization

I also cannot stress enough that you should customize the login screen once you're done, especially on anything a customer might see. The instructions below will give you the default forms login screen, which is bland and kind of ugly:

enter image description here

A few tweaks to the format of the page and/or the attached master page can make it look like this:

enter image description here

You also may have an issue with the "Employee Login" link dropping off the SOURCE parameter from the URL, which ends up with the employee being redirected back to the root page instead of whatever their destination was. This simple javascript should fix that by grabbing everything after the "authenticate.aspx" and then re-adding it to the URL as they click the button.

<script>
function employeeLogin(){
 var winURL =  window.location.href;
 var dPos =  winURL.indexOf("Authenticate.aspx");
 var dest = winURL.substring(dPos + 17);
 var newURL = "http://mysite.server.com/_windows/default.aspx?ReturnUrl=%2f_layouts%2fAuthenticate.aspx" + dest;
 window.location.href = newURL;
}
</script>

Simply call that function when clicking the button, and voila!

7
  • your end result is exactly what I want, but I don't understand everything you explain here. Can you be more precise ? Sorry to be a that weak. I can't find the Layouts folder, and if I add a html link to /_layouts/windows/default.aspx, it brings me to an error =/ Thanks in advance !
    – Nico
    Apr 2, 2014 at 11:47
  • The _layouts folder is located at C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\LAYOUTS. The _forms one is at C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\TEMPLATE\IDENTITYMODEL\FORMS. I just made a copy of that default forms folder and then pointed the default login page (in the Authentication Provider for the webapp) to my custom folder & page.
    – Omegacron
    Apr 2, 2014 at 13:28
  • Thanks for your reply ! I now see these folders. So nothing to do with the VirtualDirectories\XXXX_forms\Default.aspx ? I can put this page as the default one, right ? So why I can't add a simple html link that redirect to NTLM Authentication ? Because I don't understand : you copied your FORMS folder, in order to save it, right ? then you modified the copy (so you modify default.aspx) and you just put a html link that points on /_layouts/windows/default.aspx ?
    – Nico
    Apr 2, 2014 at 13:46
  • (Not enough caracters to edit my comment above) So, I have to copy/paste/rename the IDENTITYMODEL\FORMS folder (example, I name it CustomLogin). I change de default.aspx, and I can add the following line : <a href="/_windows/default.aspx?ReturnUrl=<%=Request.QueryString["Source"] %>">click here to login</a></td>, and then, from the central admin, I change the default page by /_identitymodel/_CustomLogin/default.aspx Am I right ?
    – Nico
    Apr 2, 2014 at 14:09
  • It works ! the path to the default page is : /_layouts/CustomLogin/default.aspx
    – Nico
    Apr 2, 2014 at 14:53
2

With SharePoint 2013 the same code will work with bit modification. As SP2013 supports code written in SP2010 as well, and it has both 14 hive and 15 hive, you need show in your code which mapped folders to look for.

In your aspx file you need to write the full path of the mapped folders as shown below /_layouts/15/images/ or /_layouts/15/

Rest of all tags and functions should work as it is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.