To enable FBA for Web Application

The following are the steps followed to enable FBA for Web Application

1.      Extend the Web Application for which FBA is required. To do so click in “Create or Extent Web Application” link in Application Management Page in Central Administration. Then click on “Extent an existing Web Application” link.

2.      Click on the Web Application dropdown and select “Change Web Application” link.

3.      Select the Web Application for which FBA has to be configured. (Here its the Enigma Primary - 6000)

4.      Check the Create a new IIS Web Site option and enter Description, Port (where you want the extended web application to run, and path for the same. Also, select the type of authentication provider, For now, select “NTLM” as the “Authentication Provider”, “No” for “Allow Anonymous” and “No” for “Use Secure Sockets Layer (SSL)”.

5.      Select the Zone for which you want to extent the Web Application. Click “OK”. This will create the Web Application.

6.      In SharePoint Central Administrator’s “Web.Config” in <system.web> section add the following Membership and Role Providers

<membership>

                  <providers>

                          <add name="ENIGMA" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="Domain.com" port="389" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="sAMAccountName" userContainer="DC=Domain,DC=com" userObjectClass="person" userFilter="(|(ObjectCategory=group)(ObjectClass=person))" scope="Subtree" otherRequiredUserAttributes="sn,givenname,cn" />

                  </providers>

          </membership>

          <roleManager defaultProvider="AspNetWindowsTokenRoleProvider" enabled="true" cacheRolesInCookie="true" cookieName=".PeopleDCRole">

                  <providers>

                          <add name="ENIGMAROLE" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="Domain.com" port="389" useSSL="false" groupContainer="DC=Domain, DC=com" groupNameAttribute="cn" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" scope="Subtree" />

                  </providers>

          </roleManager>

7.      In the newly created Web Application’s(ENIGMA INTERNET - 6005) “Web.Config” in <system.web> section add the following Membership and Role Providers.

<membership defaultProvider="ENIGMA">

                  <providers>

                          <add name="ENIGMA" type="Microsoft.Office.Server.Security.LdapMembershipProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="domain.com" port="389" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="sAMAccountName" userContainer="DC=domain,DC=com" userObjectClass="person" userFilter="(|(ObjectCategory=group)(ObjectClass=person))" scope="Subtree" otherRequiredUserAttributes="sn,givenname,cn" />

                  </providers>

          </membership>

          <roleManager defaultProvider="ENIGMAROLE" enabled="true" cacheRolesInCookie="true" cookieName=".PeopleDCRole">

                  <providers>

                          <add name="ENIGMAROLE" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="domain.com" port="389" useSSL="false" groupContainer="DC=domain,DC=com" groupNameAttribute="cn" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" scope="Subtree" />

                  </providers>

          </roleManager>

8.      Click on “Authentication Providers” link in Application Management of Central Administration Page.

9.      Select the Zone for the extended Web Application(Internet). Also, check if the correct Web Application.

10.  Select the Authentication Type as “Forms”. Enter the Membership Provider name and Role Manager Name as in the Central Admin “Web.Config” and Save the changes.

To give Permissions for Users for Portal Site, MySite and SSP

1.       In the Central Admin Page, in Application Management Click on Policy for Web Application.

2.      Select the appropriate Web Application for which the permissions have to be given (Portal Site, MySite, and SSP) and click on Add users. Note: - For all the three, (Portal Site, MySite and SSP), permissions has to be given for the extended Web Application.

3.      Select the appropriate Zone, here Intranet.

4.      Click on Browse to Search and Add users.

5.      Give the User ID/Group to add. Note: - If it’s a User ID then, add ENIGMA:Name else if it’s a group then add ENIGMAROLE:GroupName.

6.      Give the User ID/Group appropriate permissions for the given Web Application. For Portal site, MySite give Reader permissions to all the users, and for SSP give admin permission only for the Administrators.

To configure profile import with LDAP

1.      In Shared Services Administrator Page click on “User Profiles and Properties” link.

2.      In “User Profiles and Properties” page click on “View import connections”.

3.      In “View import connections” page click on “Create new Connection”

4.      In “Create New connection” page enter the values as shown for the “Connection Settings” .(Provider name depends upon which MembershipProvider being used).

5.      In “Create New connection” page enter the values as shown for the “Search Settings” and “Authentication Information” and Click “OK”.

6.      Click on “Configure Profile Import” link in User Profile and Properties page.

7.      Select “Custom Source” option in Source.

8.      Click on “Start full import” to start importing profiles using the LDAP Connectivity.

To access MySite FBA without authenticating again

1.      Ensure WSS site and MySite are running as different Web Application.

2.      Ensure they both are configured to use FBA.

3.      The cookie name for the cookie issued by both sites in web.config (Actual SharePoint site and the Extended Web Application) has to match.

4.      The Machine keys in both the web.config files mentioned above must be the following (or alternatively you can use the Machine key in one of them copied to the another)

5.      Ensure that both sites answer to the same domain name as in site1.company.com and site2.company.com. In this case you can send the domain property to be company.com so that the cookie will be presented by the browser to both sites.

If you get 401.1 Access Denied when logging on to your FBA Site

1.      If you get an ERROR like this in the Event Viewer.

Event Type:   Failure Audit

Event Source: Security

Event Category:      Logon/Logoff

Event ID:     534

Date:         7/10/2008

Time:         11:57:02 AM

User:         NT AUTHORITY\SYSTEM

Computer:     01HW102540

Description:

Logon Failure:

Reason:       The user has not been granted the requested

logon type at this machine

User Name:    IUSR_01HW102540

Domain:              01HW102540

Logon Type:   8

Logon Process:       Advapi 

Authentication Package:    Negotiate

Workstation Name:    01HW102540

Caller User Name:    inblrdhrjnjadmin1

Caller Domain:       INDIA

Caller Logon ID:     (0x0,0x16F1D7B5)

Caller Process ID:   4776

Transited Services:  -

Source Network Address:    -

Source Port:  -

2.      Click on the Virtual Directory of the FBA site in IIS Manager and go to the properties of the virtual directory, and in Directory Security section click on Edit for Authentication and access control

3.      Now, change the username and password that is entered there from the IUSR account to the domain account and click ok.

Even after adding “Domain Users” group users are getting “Access Denied” when trying to login to FBA

The OOB group “Domain Users” doesn’t work with the LdapMembershipProvider, so you can use any other group or create an equivalent group in AD.