In this post, I am going to explain the quickest possible way to enable Form Based Authentication with Active Directory which will use the new Claims Based Authentication. First thing to be aware of that, we cannot modify an existing web app which was created using Classic Mode Authentication. If we see any existing web app which uses only Windows Authentication in Classic Mode, we will see that FBA option is disabled there. So, in order to achieve our goal, we need to create a new web application and choose the following Claims Based instead of Classic Mode:

Go to Central Admin –> Application Management –> Manage Web Application –> Click New:

When we select Claims Based Authentication from the above figure, a new section opens up in the screen

In the above figure, you can see I have enabled both Windows Authentication and Form Based Authentication. I could mention the ASP.NET membership provider name here too. But, As I need to configure few things beforehand, I chose to configure this later. So, we now need to modify three web.config files for the following three applications:

1. Central Administration Site

2. The Web Application which we will be used for Claims Based Authentication.

3. Security Token Web Service Application

Go to IIS 7 of your SharePoint Web Server. Select the Central Administration Website. Right click and select “Explore” which will open up a WIndows Explorer where you will find the web.config file. Open up the configuration file using a notepad or Visual Studio and look for <system..web>.

Right before the beginning of <system.web>, Add the following section:

<connectionStrings>
   <add name="adconn"
        connectionString="LDAP://kfupm.edu.sa:389/dc=kfupm,dc=edu,dc=sa" />
</connectionStrings>

<membership defaultProvider="admembers">
   <providers>
      <add name="admembers"
           type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
           connectionStringName="adconn"
           enableSearchMethods="true"
           attributeMapUsername="sAMAccountName" />
   </providers>
</membership>

<membership defaultProvider="i">
      <providers>
        <add name="i" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthMembershipProvider, Microsoft.SharePoint, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />
        <add name="admembers" type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="adconn" enableSearchMethods="true" attributeMapUsername="sAMAccountName" />
      </providers>
    </membership>

Right Click and select “Explore” to open up the directory where you will find the web.config file for this application. Here, you will not find any <system.web> sections. So what you need to do is, go to the bottom of this file where you will find </configuration> and right before this tag, add the following:

<connectionStrings>
  <add name="adconn"
       connectionString="LDAP://kfupm.edu.sa:389/dc=kfupm,dc=edu,dc=sa" />
/connectionStrings>
system.web>
<membership defaultProvider="admembers">
  <providers>
     <add name="admembers"
          type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
          connectionStringName="adconn"
          enableSearchMethods="true"
          attributeMapUsername="sAMAccountName" />
  </providers>
/membership>
/system.web>

Do not forget to change the connection string for your Active Directory LDAP.

Now, go to the central admin and go to Application Management –> Manage Web App. Select your web app we created before for Claims Based authentication and choose Authentication Providers from the ribbon. From the pop up window, click on Default under zone and you will get the following window:

Note that, I have mentioned the provider name under ASP.NET Membership provider settings. There are other options here as well like to choose whether to use the default sign in page or to use a custom page for Forms Based Authentication. Now, my web application is ready to use both Windows and Form based authentication which will utilize the new Claims Based Authentication technology.

Let us now create a site collection to see for real. Go to Application Management –> SIte Collections –> Create Site Collection page. After setting the name and template for the new site collection, while choosing to  Site Collection Administrator, if you search for users you should get something like the following window:

As expected, I now get two instances for one name (one in Active Directory and another one is getting pulled by the new form based configuration to use with Forms Authentication). After creating this site, if I try to sign in the new site collection, I will get the following window:

You can see that two different authentications are now coming under the drop down box inside the default sign in page for my web application. If I now choose Forms Authentication, I will get the following window:

After that, if I click Sign In, I can successfully login to my new site collection. The following is the screenshot of it:

That’s it. In the next post, I will explain how you can create a custom Login Page for this Form Based Authentication and also how to create a custom Login Web Part for the same purpose which will enhance the functionality and provide better user experience in real life scenario.