Forum Discussion
Custom Claims Provider - Not possible to Login
Dear Ladies and Gentlemen,
I have set up Active Directory Federation Services (ADFS) on a server.
I have mapped User Profiles with the ADFS.
I have created a test user in Active Directory.
The Account Name in the User Profile of this Test User is following:
i:0e.t|trusted identity provider (adfs)|test_user2@stupak.ch
When I have placed this string into the people picker, people picker transformed this string into a link, which then has been added to the SharePoint group.
When I have clicked in the SharePoint group on this link, I have been redirected to the My Site of this user.
I could also login to the SharePoint site with this user.
After that I have deployed Custom Claims Provider and mapped the custom claims provider with the Trusted Identity Token Issuer:
$issuer = Get-SPTrustedIdentityTokenIssuer "Trusted Identity Provider (ADFS)"
$issuer.ClaimProviderName = "TestCustomClaimProvider2"
$issuer.Update()
When I have then selected the test user from the people picker, then I have received following link in the SharePoint Group:
c:0e.c|testcustomclaimprovider2|test_user2@stupak.ch
This Link does not lead to the User Profile and I also can not login into the SharePoint Site with this user.
Can you help me please?
Thank you very much.
With best regards
Ladislav Stupak
1 Reply
public class CustomClaimProvider : SPClaimProvider
{
// I have added following two objects into the custom claims provider class
// which inherits from the class SPClaimProvider
protected SPTrustedLoginProvider SPTrust;
protected string IssuerName => SPOriginalIssuers.Format(SPOriginalIssuerType.TrustedProvider, SPTrust.Name);
// I have added following two methods into the custom claims provider class
// which inherits from the class SPClaimProvider
public static SPTrustedLoginProvider GetSPTrustAssociatedWithCP(string providerInternalName)
{
var lp = SPSecurityTokenServiceManager.Local.TrustedLoginProviders.Where(x => String.Equals(x.ClaimProviderName, providerInternalName, StringComparison.OrdinalIgnoreCase));
if (lp != null && lp.Count() == 1)
{
return lp.First();
}
return null;
}
protected bool Initialize()
{
bool initialized = false;
if (SPTrust == null)
{
SPTrust = GetSPTrustAssociatedWithCP(ProviderInternalName);
if (SPTrust != null)
{
initialized = true;
}
}
else
{
initialized = true;
}
return initialized;
}
// I have called the method Initialize in following four methods
protected override void FillHierarchy
protected override void FillResolve(Uri context, string[] entityTypes, string resolveInput, List<PickerEntity> resolved)
protected override void FillResolve(Uri context, string[] entityTypes, SPClaim resolveInput, List<PickerEntity> resolved)
protected override void FillSearch
// I have replaced the calls of the protected SPClaim CreateClaim(string
// claimType, string value, string valueType); method which is inherited from
// the SPClaimProvider with following method. This Method below has one
// parameter more and therefore does not conflict with the method from the
// SPCLaimProvider class. The important part of this method is the parameter
// IssuerName. Because this value builds the middle part of the token. The token
// must have this part identical with the token issuer to be able to login into
// the SharePoint site.
protected virtual SPClaim CreateClaim(string type, string value, string valueType, bool inputHasKeyword)
{
return new SPClaim(type, value, valueType, IssuerName);
}
}
Following source helped me to solve this issue:
