Question

I’ve imported a bunch of users into my Active Directory with some custom fields. Then I did a profile import from Active Directory to Sharepoint with all the custom fields and regular fields. After this, I needed each user to be in a site collection with a MySite set up for them. I did that by writing some code that ensured the user existed and then checked the profile attribute “personalspace” to see if a MySite had been created. Everything worked great until some of the users needed to login from outside the network.

I’d like to get rid of the windows authentication pop-up that a user would get if they hit from outside the network (or haven’t added the site to their trusted zone in IE). I’ve extended my web application to create an internet zone. Then I edited the web.config of the internet site to do active directory forms authentication, along with editing the Central Administrator’s web.config so that it can see the data source. This is all well and good, the user can login through a nice interface. The only problem is that now the user is detached from their user profile. Essentially Sharepoint views a windows authentication user and a forms authenticated user as two separate users.

Is there a way to link the profiles? Do I have to write a custom membership provider to log a user in and then link them up to their windows account? Is there a way to log a user in from the internet web app and then spoof their windows credentials and pass it to the intranet? Do I need to recreate all the user profiles based on the forms authentication data source?

Answer 1

I’ve been trying to accomplish the same thing, with exactly the same problem – the “forms-authenticated-me” is not the same as the “windows-authenticated-me” to sharepoint, and I can’t see how to map the two.

After a lot of frustrating efforts, I think I’ve finally realized it’s not possible. In retrospect, this isn’t too surprising.

here’s an excerpt from http://msdn.microsoft.com/en-us/library/bb975136.aspx (my emphasis added)…

Deciding to Use Forms Authentication
Some organizations want to use Windows
users and groups in SharePoint
Products and Technologies, but enter
credentials via forms authentication.
Before using forms authentication,
determine why to use forms
authentication in the first place:
What is the business driver? If user
accounts are stored in a location
other than an Active Directory domain
controller, or if Active Directory is
not available in a particular
environment, using forms
authentication with a membership
provider is a good choice. But if you
want to force logon only via forms
authentication, but still use Windows
and all of the integrated features it
provides, you should consider an
alternative such as publishing the
SharePoint site with Microsoft
Internet Security and Acceleration
(ISA) Server 2006. ISA Server 2006
allows users to log on by using a
forms authentication Web form, but
treats them like Windows users after
authentication. This implementation
provides a more consistent and
compelling experience for end users.