Sharepoint 2013 Implications of Claims Mode Authentication on service applications / Managed Metadata Service about ldapcp

[Yvand]

Hi @MiikkaLehtonen,
As the log mentioned, SharePoint expects to use claims provider SPTrustedBackedByActiveDirectoryClaimProvider but since it's LDAPCP, it stops.

SPTrustedBackedByActiveDirectoryClaimProvider is a quite special, hidden claims provider that was implemented to ease migration from Windows claims to trusted authN.
It is never visible or used explicitely, the only way to use it is to create the SPTrustedIdentityTokenIssuer object using the "-UseDefaultConfiguration" switch, as documented in kb3042604.

So the short answer for you would be to delete the SPTrustedIdentityTokenIssuer and recreate it with the "-UseDefaultConfiguration" switch.
This will "disconnect" LDAPCP from the trust and link SPTrustedBackedByActiveDirectoryClaimProvider to it instead.

Unfortunately, due to the implementation of SPTrustedBackedByActiveDirectoryClaimProvider, it's very likely not going to work in your scenario:
the problem is the value used to set the entity key of each entity (aka user):
SPTrustedBackedByActiveDirectoryClaimProvider uses specifically the SID of users (remember it's used to migrate winclaims to trusted authN), but:

• I suspect SharePoint doesn't even get the SID of users in your scenario.
• LDAPCP uses the identity claim type for the entity key.

This difference means that if you switch to SPTrustedBackedByActiveDirectoryClaimProvider, you will mess up your trusted users permissions.

So, I don't know how to resolve your issue, but I would search for a way that doesn't involve using SPTrustedBackedByActiveDirectoryClaimProvider, if possible.

[MiikkaLehtonen]

Thanks. I finally decided to change users manually in the managed metadata service. Then I also had to add the Claims based All Authenticated users group to hidden Taxonomy list. The hidden Taxonomy list can be browsed by putting this on the end of your Site Collection URL /Lists/TaxonomyHiddenList/.

Miikka

[Yvand]

Ok, good news that you could do it this way