This post is migrated from previous hosting provider. There are still some issues with old posts. Please make a comment on this post with any issues.

Visual guide to Windows Live ID authentication with SharePoint 2010 - part 2

Tags: LiveID, SharePoint 2010

UPDATE 2012-02-01: A new and better approach to this is detailed in a new Visual Guide - Visual guide to Azure Access Control Services authentication with SharePoint 2010.

I'm back with the second part of the Visual guide to Windows Live ID authentication with SharePoint 2010 series. Part 1 was a huge success and has received a lot of feedback and hits - I hope many of you out there successfully configured your web sites and extranets. I'm currently working on getting the new Swedish SharePoint User Group website up using Live ID...

This second part will continue where we left it last time, and this time also using a lot of images. Jeremy Thake (MVP), who currently working on a secret SharePoint project, blogged about some of the things I will detail in this post, so for some of you there are stuff repeated in this post.

Give access to users

One of the first things you need to do is to give all Windows Live ID users the possibility to log in to your application. It's not mandatory but it is really hard asking for the PUID of all users and manually adding them to your site(s). The PUID will be seen by the user by accessing the Live ID account services at https://accountservices.passport-int.net/ or by signing in so they see the access denied page.

image

Instead of manually adding users you should add all authenticated Live ID users to a Visitors group for instance and have some kind of application form with a workflow or similar which they must fill-in to become "real members" (sounds like an InfoPath and SharePoint Designer task...). To add all authenticated Windows Live ID users to the Visitors group; log in to your site and select Site Actions > Site Permissions. Then select the Visitors group or any other group of your choice. Clicking New > Add Users will open up the Grant Permissions dialog. If you write anything in the Users/Groups field and click Check Names you will see that you can actually type anything and it will be valid.

SNAGHTML5a9d49

The Live ID authentication provider accepts any string and it does not perform a lookup with Windows Live ID, so essentially you can use any string . But users will only be sent from Live ID to your site with a PUID (nnnn@live.com), so you can't give access to a user without the PUID. If you write All users instead this will perfectly resolve to two interesting groups; The All Users (windows) and All Users (LiveID INT) - all depending on what authentication providers you have, in this case the standard Windows login and Live ID (INT) is enabled for the web application. If you select the All Users (LiveID INT) and add it to the group, all authenticated Live ID users will be a member of it.

SNAGHTML5cfca7

You can also click the Browse icon and bring up the People Picker dialog, which has a new look when claims is enabled for the web application. To select the All Users group for Live ID select the All Users node in the tree on the left hand side and then select the All Users (LiveID INT).

image

Worth noticing here is you cannot "search" for a Live ID user - not by name, e-mail or anything. You always need the exact PUID or username when claims mode is enabled.

Anonymous Access

So, now you have allowed all Live ID users to log in to your site. Enabling anonymous access to users is no different than before. First you have to change the Authentication Provider of the Web Application (Central Administration > Manage Web Applications > Select Web Applications > Click Authentication Providers in the Ribbon > Select Authentication Provider). Just check the Enable anonymous access for the authentication provider and then click OK.

SNAGHTML65b29d

Next you have to enable anonymous access per Site Collection. Once again go to Site Actions > Site Permissions and click on the Anonymous Access button in the Ribbon menu.

SNAGHTML67167e

Then select what the anonymous users can access; Entire Site, Lists or Nothing.

Once you have done this new users will not be required to log in to your site immediately. Instead they will see the "Sign In" link in the upper right corner.

SNAGHTML68c9d5

The display name of the user

Once the user logs in to the site the user name still looks pretty ugly - it's just the PUID that is given to SharePoint from the Windows Live ID login service. Unfortunately Windows Live ID only returns one single claim and that is the UPN, which is in the form of a e-mail address. That e-mail address is not even a valid address. You can not expect to get the full name or e-mail of the user from Live ID - you have to implement something of your own OR use the built-in amazing stuff in SharePoint.

SNAGHTML6a0c80

What amazing things do we have in SharePoint then? First of all - if you are on SharePoint Foundation, it's not that amazing at all. You have to live with the PUID or build something of your own and keep all your Site Collections in sync.

But if you are lucky to set up a SharePoint Server then you can take advantage of the User Profile Service Application. Configure the UPA according to all best practices - but do not configure the User Profile Synchronization (UPS), we do not need it and it does not synchronize with Windows Live ID anyways. Only configure the UPS if you are using both internal Active Directory users in combination with Live ID.

Once you have configure the User Profile Service Application go to Central Administration > Manage Service Applications and select the User Profile Service Application. Then click on Manage User Properties. We will do that to configure what properties the users are allowed to change.

SNAGHTML717eb2

You can change a whole lot of User Properties here, but the most important ones are Name and E-mail. We need to make sure that the user can edit those. Browse down to the Name property and select to Edit it.

SNAGHTML731b01

To make the Name editable and usable there are a couple of things that we need to take care of:

  1. Make sure that the property can be edited
  2. Make sure that it is visible on the Edit Details page
  3. Choose if the property is publically visible on the profile page
  4. Choose if updates to the property should be visible in the newsfeed
  5. Make sure that the property will be replicated from the profile into the userinfo list in all Site Collections

SNAGHTML747e93

Once you have configured the Name and Email property (at least) you are ready for a test drive. Log in to your site and choose My Profile from the login (upper right) menu and click on Edit My Profile. As you can see you are now able to edit the name, by default it is the PUID. Update the settings and click Save and Close and go back to the your main site.

SNAGHTML79b877

Once you get back to the site you will probably see that the PUID is still there, hold on and don't start crying yet. It takes some time to synchronize between the user profiles and userinfo lists. You can speed up the process by running the "User Profile to SharePoint Full Synchronization" job - normally run once an hour.

SNAGHTML7f5ea5

After a successful sync you should see that the upper right menu shows the Name that you specified in the user profile.

SNAGHTML81a23a

HTTPS and HTTP

There is one final thing that you should do before continuing with your site and submit it for the PROD environment and that is to allow users to browse your site without HTTPS. The login procedure must use and will still be using HTTPS. Fire up the IIS manager and select the web site that you have been using and select to edit its Bindings.

SNAGHTML850fda

Add a new Host Header binding or other binding of your choice using the HTTP protocol and then click Close.

image

Then open Central Administration and select Application Management, under Web Applications choose to Configure alternate access mappings (AAM). Choose to Edit Public URLs and then select your web application. In the Internet Zone add the URL of HTTP address, using the HTTP protocol and then click Save.

SNAGHTML8cee18

Once this is done you should be able to browse to your site using the HTTP protocol, and then if you click the Sign In link you will be taken to Windows Live ID and be authenticated. When you are successfully authenticated Windows Live ID will redirect you back to the HTTPS address (remember that you specified the Return URL in the MSM using the HTTPS protocol, in part 1). From now on you can move seamless between the HTTP and HTTPS zones.

There are other options here as well, such as extending the web apps, but that is for someone else to write about...

Summary

That's it, you should now have a fully functional Windows Live ID enabled site. You can even edit the site using SharePoint Designer using the Live ID account. Next part will give you the details on how to move this site from the INT environment to production (PROD),

Until next time...

13 Comments

  • Raghavendra Shanbhag said

    Hi Wictor, After the successfull sync i am not able to view any live id user in the User Profile Service Application associated to the web app, but the user do exist in the Users Profile List at the Site Collection level in the web app. Any idea on this

  • Raghavendra Shanbhag said

    I figured out that the Live ID Users are getting added to User Profile Store only when a mysite is created(we need to configure My Site for the web app so that user get added to user profile store)for each windows live id user. Is there any alternate way to get windows live id users in User Profile Store without creating/having My Sites for each user?

  • laurentiu said

    Hello Wictor. Everything in part 1 worked for me(HTTPS part). Now I'm trying to enable HTTP access but my site loops from _trust/default.aspx to Passport INT site. I think the problem is the site does not switch to https mode for the login. Any ideea?

  • Wictor said

    Hi, how did you extend to the HTTP protocol? You must not change the return adress specified in MMS from HTTPS to HTTP. The redirect back from the Live ID login must go to the HTTPS address.

  • laurentiu said

    @Wictor, thanks for reply. I managed to make it work with 2 modifs: 1) in the web.config i changed <forms loginurl="/_login/default.aspx"></forms> to <forms loginurl="https://www.domain.com/_login/default.aspx"></forms> 2) in my master page on page load I added this: if (Request.Cookies["FedAuth"] != null) { HttpCookie fedCookie = Request.Cookies["FedAuth"]; fedCookie.Secure = false; Response.Cookies.Add(fedCookie); } This is because the Fed cookie is send only for secure connections. Now everything works like a charm. When should I expert part 3(wsitch to prod)?

  • Trackback said

    Here is the third part of my Visual guide to Windows Live ID authentication in SharePoint 2010. This part takes off just where we ended the last part. If you haven't read part 1 and part 2 then make s...

  • Yogesh Badgujar said

    Hi, I am not able to login to sharepoint site using live ID credentials. It says : "Email id or password is incorrect." I gave same credentials which I used for registering my site at Microsoft Service Manager. I used certificate from Windows Live ID Server SDK.

Comments have been disabled for this content.

AWS Tracker

About Wictor...

Wictor Wilén is a Director and SharePoint Architect working at Connecta AB. Wictor has achieved the Microsoft Certified Architect (MCA) - SharePoint 2010, Microsoft Certified Solutions Master (MCSM) - SharePoint  and Microsoft Certified Master (MCM) - SharePoint 2010 certifications. He has also been awarded Microsoft Most Valuable Professional (MVP) for four consecutive years.

And a word from our sponsors...

SharePoint 2010 Web Parts in Action