I have a question because what I would like to ask is not very well documented on the Internet. I have recently been working on a migration of a classic auth. NTLM SP2010 solution to claims. The solution incorporates ADFS as Trusted Identity Provider (ADFS source is AD, two domains: INT and EXT with a trust between them).
What I have done so far and what is working:
- I have installed and configured ADFS and Sharepoint 2010 as relying party,
- I have defined aforementioned ADFS as TIP in Sharepoint
- connecting the two above: logging in using ADFS works fine,
- I have created and deployed custom claims provider to assure proper name resolution of users and groups,
- I have deployed a sliding session module (users get logged out after 30min. of inactivity)
- I have migrated the web app (including setting proper values for portalsuperreader and portalsuperuser)
- I have created, tested and used a PowerShell script that migrates user’s and group’s logins to trusted identity provider claim encoded value (instead of standard windows claims encoding)
- I have extended Search Service to windows auth. to assure crawling is still working (added appropriate setting in content sources and server mappings: no top level errors)
Now some problematic things:
- after migrating users to claims users can access My Sites BUT when they browse to “My content” a brand new page is created. I have done some research and I have found out that defining a TIP changes default path to user’s personal page. I guess I need a script that will map them back to appropriate ones ? Somewhere else I have read that before doing anything to UPS I should turn off User Profiles Cleanup Job? Do you have some hints about UPS when converting to claims ?
- after conversion the keywords are gone. is there anything specific about Metadata Service that I should know and do during converting to claims?
- as I said I moved users using a PS script mentioned above, when I list users I see their logins are converted to a proper format. However, various sites (under portaladdress/sites/....) are not accessible by respective users. When I get such an SP-Web of such SP-Site into a variable using PS and look at SiteAdministrators I see all of them have correct formatting. However, when I browse to permissions settings of this page in browser I see these users (primary and secondary admin) underlined in red (although the name is correct). I understand that this is in red because my custom claims provider is set to resolve by various AD params like sAMAccountName, mail etc. but I forgot to implement resolution by claim encoded user id. Nevertheless, can it be influencing this that much that users are not able to login (after all I think that People Picker “ability” to resolve a person that is already assigned does not influence a particular resource availability)
If you had any other tips, advices or maybe links to resources that treat about such considerations (especially services and service applications configuration after converting to claims) I would be really thankful if you shared them with me.