0

I have configured my SharePoint 2010 as it says on Configuring SharePoint 2010 and ADFS v2 End to End and authentication works. However, on my people picker "SAML Provider" is not shown. Also I can not search for any user and/or AD groups, and I can not add it inside web application / site collection. Environment is: ADFS 2.0, Windows Server 2008 R2, SharePoint 2010 with SP1., ADFS is using only local AD domain.

I have created "SAML Provider" for use with AD FS 2.0

$map1 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming
$map2 = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -SameAsIncoming
New-SPTrustedIdentityTokenIssuer -Name "SAML Provider" -Description "SharePoint secured by SAML" -realm "urn:seo:sharepoint" -ClaimsMappings $map1,$map2 -SignInUrl "https://adfs.mycompany.com/adfs/ls" -IdentifierClaim $map1.InputClaimType -ImportTrustCertificate (Get-PfxCertificate \\MYFileServer\share\ADFS-SP.cer)

Create Web Application with authentication provider

New-SPWebApplication -Name "My Lab2010 Site" -Port 443 -HostHeader sp.mycompany.com -URL "https://sp.mycompany.com" -ApplicationPool "MyLab2010SiteAppPool" -ApplicationPoolAccount (Get-SPManagedAccount "sp-siteapppool") -SecureSocketsLayer -DatabaseName "MyLab2010Site" -DatabaseServer "mysqlsrv\sp" –AuthenticationProvider (Get-SPTrustedIdentityTokenIssuer -Identity "SAML Provider")

Create new site collection from Team Site english template:

New-SPSite -Name "My Lab2010 Site" -URL "https://sp.mycompany.com" -OwnerAlias "[email protected]" -Language 1033 -Template "STS#0" -SecondaryOwnerAlias "[email protected]"

Here I do have only System, Active Directory, All Users and Forms auth

Get-SPClaimProvider

I have noticed that I am missing something ?

Improve this question

1 Answer 1

Reset to default
2

When you configure saml on SP there is no people picker. This is because SP does not know where the users are. ADFS is not a user store it is a security token service that issues a tokens when a user is authenticated. Nothing else.

You could implement your own claims provider that speaks with AD. There are some articles on the net:

Another alternative would be using something lime Auth0 (full disclosure: I work there)

http://blog.auth0.com/2013/05/04/A-much-better-People-Picker-for-SharePoint/

Improve this answer
3
  • Ok, thank you. So, without people picker, how can I use Active Directory Groups in my scenario ? how can I assign permissions to them for example ?
    – Hrvoje Kusulja
    Jun 26, 2013 at 15:11
  • You would have to send the groups on the SAML token (creating a rule on ADFS), use PowerShell on SharePoint to make sure those claims are passed through and then on the people picker you would have to type those group names by hand (there is no look up against AD).
    – woloski
    Jun 27, 2013 at 2:15
  • I think I have done this by tutorial (link in my first question) - enabled groups for auth. If this is not what you mean please be more specific and any additional link for configuring this would be highly appreciated. So without people picker and ClaimsProvider, how can I add permissions to another user and/or group from my AD FS. Simple does not accept my input, but default site collection admins are added and works normally. Thank you
    – Hrvoje Kusulja
    Jun 27, 2013 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.