I have a question because what I would like to ask is not very well documented on the Internet. I have recently been working on a migration of a classic auth. NTLM SP2010 solution to claims. The solution incorporates ADFS as Trusted Identity Provider (ADFS source is AD, two domains: INT and EXT with a trust between them).

What I have done so far and what is working:

  • I have installed and configured ADFS and Sharepoint 2010 as relying party,
  • I have defined aforementioned ADFS as TIP in Sharepoint
  • connecting the two above: logging in using ADFS works fine,
  • I have created and deployed custom claims provider to assure proper name resolution of users and groups,
  • I have deployed a sliding session module (users get logged out after 30min. of inactivity)
  • I have migrated the web app (including setting proper values for portalsuperreader and portalsuperuser)
  • I have created, tested and used a PowerShell script that migrates user’s and group’s logins to trusted identity provider claim encoded value (instead of standard windows claims encoding)
  • I have extended Search Service to windows auth. to assure crawling is still working (added appropriate setting in content sources and server mappings: no top level errors)

Now some problematic things:

  • after migrating users to claims users can access My Sites BUT when they browse to “My content” a brand new page is created. I have done some research and I have found out that defining a TIP changes default path to user’s personal page. I guess I need a script that will map them back to appropriate ones ? Somewhere else I have read that before doing anything to UPS I should turn off User Profiles Cleanup Job? Do you have some hints about UPS when converting to claims ?
  • after conversion the keywords are gone. is there anything specific about Metadata Service that I should know and do during converting to claims?
  • as I said I moved users using a PS script mentioned above, when I list users I see their logins are converted to a proper format. However, various sites (under portaladdress/sites/....) are not accessible by respective users. When I get such an SP-Web of such SP-Site into a variable using PS and look at SiteAdministrators I see all of them have correct formatting. However, when I browse to permissions settings of this page in browser I see these users (primary and secondary admin) underlined in red (although the name is correct). I understand that this is in red because my custom claims provider is set to resolve by various AD params like sAMAccountName, mail etc. but I forgot to implement resolution by claim encoded user id. Nevertheless, can it be influencing this that much that users are not able to login (after all I think that People Picker “ability” to resolve a person that is already assigned does not influence a particular resource availability)

      If you had any other tips, advices or maybe links to resources that treat about such considerations (especially services and service applications configuration after converting to claims) I would be really thankful if you shared them with me.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.