ADFS and SharePoint on premises - Really the right way ?

[Dominik Justen]

All of our SharePoint 2013/2016 installations use ADFS as STS together with HNSC. From what I read this is supposed to be best practice and while I don't mind (actually like) the HNSC part, using anything but Windows claims seems to give us a lot of grief.

• People picker accepts any value. This is a known problem which might be fixable by throwing some custom code and customization at SharePoint, it still leaves a weird taste
• Most of the mobile apps (IOS) simply don't work with claims while they all claim to work when NTLM is utilized.
• Because NTLM needs to be enabled on the web application for search and the likes, user are asked which identity provider the would like to use. Again -  we could throw some custom code at the system or override the url of the sign on page. It still feels somewhat clumsy.
• If in the mean time someone manages to log on using windows auth a second profile for that user is created (one for ADFS and the second for windows auth) in the user profile service. This seems to break SP2013 workflows because they rely on UPS and now get confused by the two profiles - at least that's what I experienced and read. Deleting the windows auth profile fixes the issue.
• Our biggest problem right now is that alerts don't work or stop working when using claims authentication with ADFS. The ULS logs didn't help me so far and we really need to understand why that is happening.

Anyway, I'm sure you get my point. Is using ADFS for an SP2013 on prem installation really the right way to go ?

[#2]

You can still use ADFS, just use a non-claims aware relying party instead. This way you change nothing on SharePoint (except enable Kerberos) and the behavior is as your users previously experienced it.

[#3]

So you say: Use Windows Claims inside of SharePoint and no ADFS Services as IDP. But use Web Application Proxy for publishing SharePoint as an non-claims aware application ?

[#4]

That's correct. Or use another RP appliance.

[#5]

Hi Trevor,

I was about to use ADFS with SharePoint 2013 to enable SSO with another third party application hosted on ColdFusion and using a custom database, by creating trust between ADFS and STS of that application, let me know if that is the right way to go?

Thanks

Paramdeep Singh

[#6]

As long as your CF app supports SAML or Windows Kerberos auth, sure. That's less of a technical question and more of a business decision.

[#7]

HI Trevor, 

I have similar situation with one external face hub site using ADFS/SAML. I need to publish an SharePoint 2016 site for external access, and hub site can have single sign-on to SP2016 site. As current SP2016 site is using Kerberos and has lot of SSRS reports, BI an data warehousing connections, it is might not be suitable to use ADFS/SAML as ideneity provider. 

Could you please kindly advise whether by using ADFS 3.0 non-claim aware to publish SP2016 site will give me SSO from hub site (SMAL) to SP2016 site (Kerberos)? Thanks.