I am currently tasked with planning authentication for a new SharePoint 2013 site. My goal is to allow users to sign on using Windows Authentication, however once they login I would like to query a SQL database to gather a list of permissions and details about what files they can see.

At first I was thinking of using ADFS, and having it send a token that includes all the necessary information.

However, is it possible to simply use Windows Auth and then query the database at the time the user hits the site. Once the user hits the site, can I hide and show files depending on the information retrieved from the database?

  • Welcome to SharePoint StackExchange :) Commented Jan 17, 2014 at 5:06

1 Answer 1


Firstly let me say that this is very feasible, but will not be without a significant amount of effort both in thinking through the right design and in implementing it. There is no quick fix here, having said that here are your options.

What you basically need to look at is Augmented Claims, that is to say you need a way to augment the set of claims that SharePoint is aware of for your authenticated users. SharePoint allows you to secure items against claims.

You can do claims augmentation in several ways but the two most common are:

ADFS - You have already hinted at this but if ADFS is used as a custom identity provider for your application then you can use ADFS claim rules and Attribute Stores to query the SQL database and assign new claims to your user. You then just need to secure SharePoint using these new claims. If you are following this route then basically read everything that Steve Peschka has ever published on the subject, starting with this:


To find more information on using a SQL Attribute Store in ADFS to augments claims take a look at this:


Custom Claim Provider - You can write a Custom Claim Provider for SharePoint and register it against your web application, you will need to write all the code to query the database and process the returned values, but I am assuming that is not a problem. This option actually gives you more control over the user experience in securing SharePoint as ADFS on its own will not allow you to integrate any validation or search aspects into the Claim Picker (People Picker). In fact worse than that it will appear that any value searched for in the People Picker is valid whether it exists as a valid attribute value or not, this is very open to human error when securing items in SharePoint so you may wish to consider a hybrid approach which uses ADFS for the augmentation of claims, but has a Custom Claim Provider as well to allow you to search and resolve names from your SQL database.

More information and a starting point for Custom Claim Providers can be found here:


Though again Steve Peschka has written lots of blog posts on this subject and I recommend taking a look through all of them as you build out a design.

This is just a kick start in the right direction and no doubt you will have more questions before you get all the answers you need.

Hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.