Sign in
 

none
SharePoint 2010 with ADFS 2.0 and User Profile Import

 > 

    Question

  • Question
    Sign in to vote
    1
    Sign in to vote

    Yes! I finally have SharePoint 2010 working with ADFS 2.0. I must say it's working like a charm.

    We have a lot of roaming users (who access SharePoint from the intranet and from the internet, sometimes from a domain computer and other times from a workgroup machine). I've set up an AD federation server for internal access and an AD federation server proxy for external access. All is working great. I've also created the claims viewer webpart as described by Travis Nielsen.

    I have configured the SPTrustedIdentityTokenIssuer with the following claim type 

    $map = New-SPClaimTypeMapping -IncomingClaimType "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress" -IncomingClaimTypeDisplayName "EmailAddress" -SameAsIncoming

    as the unique identifier. I can also add other claim types (in the SPTrustedIdentityTokenIssuer and in the ADFS 2.0 relying party claim rule) and they show up correctly in the claims viewer webpart.

    So far so good.

    I now want to import the users profiles from AD. I've succesfully set up the profile import on our AD and the user profiles get imported properly. But... There's no mapping between the user profile's and ADFS user.

    For example:

    • Our domain is contoso.com
    • My username is marcvaneijk
    • my emailaddress is marcvaneijk@contoso.com

    When i login through the Federation Server (proxy) with my user account contoso\marcvaneijk and password. I get identified in SharePoint with the unique claimtype i specified in the SPTrustedIdentityTokenIssuer i:05.t|adfs20|marcvaneijk@contoso.com

    When i look at the user profile service application in Central administration and search for my user profile i get 2 results.

    • i:05.t|adfs20|marcvaneijk@contoso.com
    • contoso\marcvaneijk

    The user profile import doesn't map to the ADFS logon.

    I have deleted both profiles and then run a full user profile import again. Confirmed that only one profile existed for my account (constoso\marcvaneijk) and then logged on through ADFS again. Once again i end up with two profiles.

    Does anybody know how to map the user profile import to the claims (or map the claims to the user profiles), so the ADFS logon get's mapped to the imported user profile.

    Friday, June 4, 2010 7:58 AM
    |

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Brad, your situation can be handled in SP2010 much better, but it's not really related to the profile sync.  That would of course become a topic of discussion, but you have a much higher-level situation that needs to be handled first.  I would recommend that you utilize Unified Access Gateway (UAG) to connect all those domains together and then connect that to SharePoint so that all of your users can access SharePoint from a single user repository.  Claims-based authentication and ADFS 2.0 may come into play, but you have many pieces that need to be considered.

    Yes, the profile sync service still works with ADFS 2.0 in the picture.  In my test farm, I have two separate forests (internal company and external company), and I'm using Claims Based Authentication to allow direct access to the SP2010 sites for the external users who are never given an account internally.  ADFS 2.0 allows me to pass the email address of the external user as a claim to the SP2010 site through my internal ADFS 2.0 server (external forest has an ADFS 2.0 server, too, and they talk to each other).  My profile sync pulls in all the users from the external forest with no problem.

    SharePoint Architect || Microsoft MVP || My Blog

    Friday, June 11, 2010 8:04 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Brad,

    Like Clayton said, there two different issues in your question.

    • authentication
    • user profile synchronisation

    If we look at authentication. The traditional (before ADFS) config to support authentication from multiple domains would be to create a trust between domains. This required a VPN tunnel and multiple ports to be opened between the two domains. And like your scenario for political reasons wasn't always a possibility. With the introduction of ADFS in Windows 2003 R2 the amount of ports needed to be opened was reduced to one (443) and since the traffic was over SSL a dedicated VPN was no longer required.

    ADFS (2.0 is the current version) provides two scenario's for SharePoint 2010

    • web sso
    • federated web sso

    Web Sso creates a single signon functionality betwen different SSL URLs for external (and possible internal) employees. With Web SSO we're still talking about a single single domain scenario.

    Federated Web Sso creates a single signon functionality between different SSL URLs for different domains. This creates the following scenario: The Sharepoint 2010 environment in Domain A is accessed by a user who is loggod on with his domain account in domain B. The user doesn't get prompted for his credentials. Instead the ADFS 2.0 infrastructure handles authentication for him and provides him with a claims token to access the sharepoint environment.

    The second piece of the puzzle (there are more then two i can assure you) is user profile synchrinzation.

    When you are working with SharePoint Server and not Foundation, we're speaking about two profiles.

    • SharePoint Foundation profile
    • SharePoint Server profile

    A Sharepoint Foundation profile gets created in each site collection once you logon to the site collection. The profile looks up information in AD about the user who's logging on. If you're working with ADFS 2.0 no information can be found in AD so only the claims provided will be shown in this profile. The profile for the same user can be different for two different site collections.

    Once you configure SharePoint Server User Profile Synchronization the SharePoint foundation profile get's deprecated. The User profile synchronization will sync AD information to SharePoint. There are two timer jobs that sync this information to the SharePoint foundation profiles in the different site collections.

    So after a lot of trail and error i found out that the key to configuring the User Profile syncronization is how you configure the Connection (use your Identity Provider to connect to the domain) and you'll also have to adjust a profile mapping (claims ID should map to the unique claims mapping of the SpTrustedIdentityTokenIssuer). Because like Clayton said, if you only configure the User Profile sync to connect to AD you'll end up with two different profiles for the same AD user (as specified above)

    So since i was unable to find any documentation on how i should configure this i writing a complete step by step guide on how you should configure this (i have got it working for the web SSO). You can find it on my blog.

    Marc

    Saturday, June 12, 2010 9:25 AM
    |

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Marc, I do have CBA working and have it working with an external forest, but I have not gotten the proxy to work yet.  Do you have a good article for that?  I haven't been able to pass the claims through my proxy - only directly to the internal STS.

    Anyway, my profile import is working for both internal and external users.  What exactly do you mean when you say the user profile is not mapped to the claim?  What is your indicator?  Aren't you logging in as a user that exists in the domain and doesn't need to use claims, which means he therefore has a regular Windows Auth profile?

    SharePoint Architect || Microsoft MVP || My Blog
    Sunday, June 6, 2010 4:31 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Clayton,

    Thanks for your reply and once again congrats on your MVP status. Concerning the FS proxy i just followed the technet checklist and all is working as expected (my FS proxy is in a workgroup).

    And for the user profile import. I have one AD domain and want to provide Web SSO access to sharepoint for all domain users through ADFS 2.0. When the user is in the office and connects to SharePoint he gets directed to Federation Server. When the same user is out of the office and connects to SharePoint he gets directed to the Federation Server Proxy.

    So all users only login to SharePoint through ADFS 2.0

    The SharePoint profiles get imported by the User Profile Import from the same AD domain. When a user logs on through ADFS, SharePoint creates a new profile for this user. So i'm stuck with two profiles for the same AD account (although i only logon through ADFS)

    When i look at the user profile service application in Central administration and search for my user account i get 2 results.

    • i:05.t|adfs20|marcvaneijk@contoso.com
    • contoso\marcvaneijk
    Sunday, June 6, 2010 5:58 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Well yeah, that's expected.  Why are you forcing users to go through the STS even when internal?  Isn't it much more of an administrative hassle?

    Anyway, when you use claims, the users are considered completely separate entities.  You would need to only import the claims identities and not the regular windows identities.  When you set up your profile sync, I'm assuming you just pointed to AD and didn't specify anything related to the claims identity provider, right?

    Yeah, I've been through the checklists, but they weren't actual guides that I could follow step-by-step, so it didn't help me.  I am missing something still.
    SharePoint Architect || Microsoft MVP || My Blog
    Sunday, June 6, 2010 6:07 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Yes when i configured the profile sync i just pointed at AD and didn't specify anythig related to the claims identry provider. The problem is that i don't know what i should configure in the profile sync. What settings should i use when i Add A New Synchronization Connection. Is there anything i should adjust in the Manage User Properties.

    To generalize the question. How do i get the information in AD synced to the ADFS login in SharePoint.

    For the ADFS 2.0 proxy maybe this can help you out.

    Sunday, June 6, 2010 6:22 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    I don't know if they can be synced.  I would think that what you want to do is only import the claims identities so that they associate with themselves instead of trying to tie them to separate identities.  I don't know how you'd do the latter.  The key would be figuring out what to specify in the sync connection, which I don't know yet and haven't seen posted yet, but that would be the angle I'd try.
    SharePoint Architect || Microsoft MVP || My Blog
    Sunday, June 6, 2010 7:00 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Marc,   We ended up creating a custom sync method in code to force a sync on user login in our environment running w/ a custom claims based provider.  The code was fairly straight forward, using methods from the built in UserProfileManager class.  Let me know if this sounds like something that would help you and I will post a scrubbed version of the code.

    Good luck,

    Monday, June 7, 2010 10:45 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Please pardon me for going a bit off topic here.

    We have approx 100 locations and 3 separate employee domains (political reasons). We are also looking at creating yet another domain for customers. Our VPN software is simply awful so the plan is make SharePoint available from the internet. 

    I don't know anything about ADFS 2.0. It looks like ADFS 2.0 would allow users from all 4 domains to authenticate and collaborate in SharePoint 2010 (please tell me if I'm wrong), but I'm having trouble deciphering what you guys are saying about profile sync. Does profile sync work when ADFS 2.0 is in the picture?

    Friday, June 11, 2010 7:45 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Brad, your situation can be handled in SP2010 much better, but it's not really related to the profile sync.  That would of course become a topic of discussion, but you have a much higher-level situation that needs to be handled first.  I would recommend that you utilize Unified Access Gateway (UAG) to connect all those domains together and then connect that to SharePoint so that all of your users can access SharePoint from a single user repository.  Claims-based authentication and ADFS 2.0 may come into play, but you have many pieces that need to be considered.

    Yes, the profile sync service still works with ADFS 2.0 in the picture.  In my test farm, I have two separate forests (internal company and external company), and I'm using Claims Based Authentication to allow direct access to the SP2010 sites for the external users who are never given an account internally.  ADFS 2.0 allows me to pass the email address of the external user as a claim to the SP2010 site through my internal ADFS 2.0 server (external forest has an ADFS 2.0 server, too, and they talk to each other).  My profile sync pulls in all the users from the external forest with no problem.

    SharePoint Architect || Microsoft MVP || My Blog

    Friday, June 11, 2010 8:04 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Brad,

    Like Clayton said, there two different issues in your question.

    • authentication
    • user profile synchronisation

    If we look at authentication. The traditional (before ADFS) config to support authentication from multiple domains would be to create a trust between domains. This required a VPN tunnel and multiple ports to be opened between the two domains. And like your scenario for political reasons wasn't always a possibility. With the introduction of ADFS in Windows 2003 R2 the amount of ports needed to be opened was reduced to one (443) and since the traffic was over SSL a dedicated VPN was no longer required.

    ADFS (2.0 is the current version) provides two scenario's for SharePoint 2010

    • web sso
    • federated web sso

    Web Sso creates a single signon functionality betwen different SSL URLs for external (and possible internal) employees. With Web SSO we're still talking about a single single domain scenario.

    Federated Web Sso creates a single signon functionality between different SSL URLs for different domains. This creates the following scenario: The Sharepoint 2010 environment in Domain A is accessed by a user who is loggod on with his domain account in domain B. The user doesn't get prompted for his credentials. Instead the ADFS 2.0 infrastructure handles authentication for him and provides him with a claims token to access the sharepoint environment.

    The second piece of the puzzle (there are more then two i can assure you) is user profile synchrinzation.

    When you are working with SharePoint Server and not Foundation, we're speaking about two profiles.

    • SharePoint Foundation profile
    • SharePoint Server profile

    A Sharepoint Foundation profile gets created in each site collection once you logon to the site collection. The profile looks up information in AD about the user who's logging on. If you're working with ADFS 2.0 no information can be found in AD so only the claims provided will be shown in this profile. The profile for the same user can be different for two different site collections.

    Once you configure SharePoint Server User Profile Synchronization the SharePoint foundation profile get's deprecated. The User profile synchronization will sync AD information to SharePoint. There are two timer jobs that sync this information to the SharePoint foundation profiles in the different site collections.

    So after a lot of trail and error i found out that the key to configuring the User Profile syncronization is how you configure the Connection (use your Identity Provider to connect to the domain) and you'll also have to adjust a profile mapping (claims ID should map to the unique claims mapping of the SpTrustedIdentityTokenIssuer). Because like Clayton said, if you only configure the User Profile sync to connect to AD you'll end up with two different profiles for the same AD user (as specified above)

    So since i was unable to find any documentation on how i should configure this i writing a complete step by step guide on how you should configure this (i have got it working for the web SSO). You can find it on my blog.

    Marc

    Saturday, June 12, 2010 9:25 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Clayton, Marc

    Thank you both for your detailed replies. You gave me a lot to think about. It seems that ADFS and UAG have overlap in what they do - and that UAG may be the better option for us - though I'm concerned about UAG cost because we have standard cals and it is an ecal product.

    To my knowledge our employee domains are in different forests. If we could convince the owners of the domains to establish trusts between them could we/should we avoid using ADFS and/or UAG altogether?

    Brad

    Monday, June 14, 2010 6:21 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    The trusts will be trickier when it comes to using all those users in SharePoint.  UAG allows you to treat them like one user repository for SharePoint as far as I know, but I haven't physically done it myself yet.
    SharePoint Architect || Microsoft MVP || My Blog
    Monday, June 14, 2010 8:33 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello Tim,

    we are also looking for a solution and it sounds like your way (custom sync method) could help us and we are very interested in your code.

    Do you use profile sync service at all (with a kind of merging synced profiles and claims from login)?

    Or do you fill each profile only when the user logs in, meaning that users in profile DB exist only after first login?

    Can your solution be used for permission policy, e.g. determine which role/claim can visit or contribute to which sites? Can it be used with audiences?

     

    We need sigining in against an STS, because we need single-sign on with other applications, but we are still not sure if we should write a custom ClaimProvider or use ADFS or a use mixture of custom STS and AD sync:

    does anybody know, how ADFS-claims from login fit into claims/properties provided by profile sync? There are claims from ADFS at logging in and there are claims from profile sync (against AD or ADFS). Which ones are shown in user profile? And which ones are used in permission policies?

    I found no documentation about this point at all.

    Any help welcome,

    Ina

     

     

     

     

    Monday, July 19, 2010 6:20 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Marc,

    Facing same issue, please let me know the solution if you have.

     

    Thanks, Sachin Jagtap
    Tuesday, April 26, 2011 6:26 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi tim,

    Please send me the details of custom sync method in code for user profile syncronization.

     

    Thanks, Sachin Jagtap
    Tuesday, April 26, 2011 6:28 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Any resolution here?  Sorry if this is the wrong forum... but we had the ADFS sync working last summer but since the October & December CU's haven't been able to have the 2 user profiles sync (AD & ADFS) to SharePoint UPS.  Anyone else having the issue... we have ticket with MS but they haven't been able to find a resolution beyond saying it's a bug and they are working on it.

    Thanks!

    Tuesday, May 17, 2011 6:22 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Marc,

    In the profile sync you can specifiy the mapping between AD properties and SharePoint properties (Manage User Properties). One of these properties is 'Claim User Identifier'. Here you can specifiy a property in the AD that matches your identifying claim value (marcvaneijk@contoso.com). Sharepoint wil use this property to match a claim-login to an AD user in the profile sync.

    Hope this helps,

     

    Arjan

    • Proposed as answer by S.Hansen Friday, September 16, 2011 6:17 PM
    Monday, August 1, 2011 2:26 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    Deleted
    Tuesday, August 23, 2011 6:40 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    I know this thread is old,  but using the email claim value worked for me to map ADFS profiles to AD information, Arjan.

     

    S.Hansen
    Friday, September 16, 2011 6:18 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Hansen,

    Can you provide some direction or instructions on how to do this?

    Ebenezer
    Monday, December 19, 2011 5:52 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Is there any other resolution except creating custom sync method?

    Any news on this issue?

    (I am facing it again in SharePoint 2013)

    Monday, November 19, 2012 11:22 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Tsvetelin,

    I have configured SharePoint 2013 and User Profile import sucessfully with Claims. Please let me know the issue your facing so that I will help you.

    Thanks, Sachin Jagtap

    Thursday, December 13, 2012 7:31 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    We ended up creating a custom sync method in code to force a sync on user login in our environment running w/ a custom claims based provider.  The code was fairly straight forward, using methods from the built in UserProfileManager class.  Let me know if this sounds like something that would help you and I will post a scrubbed version of the code.



    • Edited by gull faraz Friday, December 14, 2012 7:41 AM
    Friday, December 14, 2012 7:27 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Sachin,

    Our scenario: we have AD for internal access and we want to provide claims-based authentication for external access for the same people.

    The problem is that UPSA creates two different profiles for the claims user and the AD user, althought the mappings are configured...


    Saturday, December 15, 2012 9:25 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi gull,

    It sounds like a possible solution...

    Please do post the code!

    Saturday, December 15, 2012 9:27 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Tsvetelin,

    I think gull solution will work for you :)

    Thanks, Sachin Jagtap

    Monday, January 14, 2013 8:05 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    Tsvetelin, you can't map two users together in SharePoint.  They are authenticated by different identity providers, therefore different users to SharePoint.  Your best approach is to use claims for all users with the same trusted identity provider (ADFS for example) internal and external rather than using the integrated Windows authentication.  The identity provider is the same, so the user is the same and you can still get all the benefits that Windows integrated provides, SSO for example, using ADFS.  We extended our site to another zone and use the default Windows zone for crawl and farm administrative purposes only.  Using ADFS with split DNS, you can direct internal and external users to the proper ADFS server.  Internal users get authenticated via passthrough authentication and external users via login form or prompt.
    Tuesday, March 5, 2013 10:00 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi there, 

    I know this is an old thread but,  Ive had this situation before and its the same as have 2 profiles when you use forms based authentication and integrated authentication.

    Your best bet is to use TMG or UAG to handle the authentication, then as far as sharepoint is concerned, it only see's an integrated NTLM profile.

    I hope this helps (or helps anyone else who has found this thread) :)

    troy

    • Proposed as answer by Troy Dawson Wednesday, April 17, 2013 4:23 AM
    Wednesday, April 17, 2013 4:23 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I have exactly the same issue.. 

    is there actually a solution for this scenario?

    Sven

    Sunday, April 28, 2013 11:31 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I have same issue but I have TMG for NTLM login and ADFS 2.0 for Claim login, when I try to login using TMG or the ADFS for the same user account it's dealing with it as two different user profiles.

    is there any solution for this??!!

    Ismail

    Ismail Kiswani

    Sunday, April 28, 2013 2:17 PM
    |