Unless otherwise noted, the information in this article applies to both Microsoft Search Server 2008 and Microsoft Search Server 2008 Express.
This article includes sample configuration settings for several common forms-based authentication and Web single sign-on (SSO) authentication providers.
In this article:
SQL membership provider
Active Directory membership provider
LDAP membership provider
Web SSO with AD FS
SQL membership provider
The following table provides examples of Web.config file entries for using ASP.NET forms-based authentication to connect to a SQL membership provider.
Configuration steps
Description and example Web.config file entries
Turn on ASP.NET forms-based authentication.
You can set the authentication type for a particular zone to forms-based authentication on the Edit Authentication page on the Search Central Administration Web site.
This automatically changes the mode specified in the authentication element of the Web.config file for that zone to forms.
For example:
<authentication mode="Forms">
</authentication>
Register the membership provider.
If you are using Microsoft SQL Server database software on the local server as your membership provider database, and you specify AspNetSqlMembershipProvider for the membership provider name, you might not have to make any additional changes to the Web.config file. In this scenario, if the machine.config file has the correct configuration for the AspNetSqlMembershipProvider, you can use it for Windows SharePoint Services without making any changes.
If the default configuration in the machine.config file does not apply (for example, if you want to use a SQL Server database on a remote server), you must edit the Web.config files for both the Web application and the Central Administration Web site to specify the connection information in the connectionStrings element for the membership provider database.
Replace SQLSERVERMACHINE with the name of server computer on which you have installed the SQL Server membership database.
Next, add the membership and providers elements to register the membership provider in the Web.config file. Because a default provider is already registered in the machine.config file, you must include a <remove> element in front of the <add> element.
The membership element must be included within the system.web element of the Web.config file for both the Web application and the Central Administration site.
Register the role manager (optional).
You can use the default role provider for ASP.NET by adding a roleManager element to the system.web element of the Web.config file. For example:
<roleManager enabled="true" />
The previous syntax uses the AspNetSqlRoleProvider, which is defined in the machine.config file. This role manager can connect to the ASPNETDB database in either the local or remote instance of SQL Server. If you want to use a SQL Server database on a remote server as your role provider database, you must edit the Web.config file to specify the connection information for the remote database server.
Replace SQLSERVERMACHINE with the name of the remote server that hosts the SQL database. You can specify the same connectionStringName element value for both the membership provider and role manager. Therefore, you do not have to add a new connectionStrings element for the role provider. However, if you want to use a different database for the role provider, you must add a separate connectionStrings element for the role provider.
Next, you must add the roleManager and providers elements to register the roleManager provider in the Web.config. Because a default provider is already registered in the machine.config file, you must include a <remove> element in front of the <add> element.
<add connectionStringName="SqlProviderConnection" applicationName="/" description="Stores and retrieves roles data from the local Microsoft SQL Server database" name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</providers>
</roleManager>
The roleManager element must be included within the system.web element of the Web.config file for both the Web application and the Central Administration Web site.
Register the HTTP module.
Not applicable
Active Directory membership provider
The following table provides examples of Web.config file entries for using ASP.NET forms-based authentication to use an Active Directory directory service membership provider.
Note
This will only work in a scenario with a single domain.
Configuration steps
Description and example Web.config file entries
Turn on ASP.NET forms-based authentication.
You can set the authentication type for a particular zone to forms-based authentication on the Edit Authentication page in Central Administration.
This automatically changes the mode specified in the authentication element of the Web.config file for that zone to forms.
For example:
<authentication mode="Forms">
</authentication>
You can also specify the logon page URL in the forms element, for example:
If you want to use an Active Directory server for a membership provider, you must edit the Web.config file to register the membership provider. To do this, you must specify the connection information to the Active Directory server in the connectionStrings element.
The previous example does not specify account credentials. If you do not specify account credentials, your application's process identity is used to access Active Directory.
If another account is required to access Active Directory, you can specify different account credentials in the connectionUsername and connectionPassword attributes, which means that you are supplying the user name and password in plaintext. As a result, we recommend that you encrypt this configuration section. For more information, see the following articles:
The following table provides examples of Web.config file entries for using ASP.NET forms-based authentication with a Lightweight Directory Access Protocol (LDAP) membership provider.
Configuration steps
Description and example Web.config file entries
Turn on ASP.NET forms-based authentication.
You can set the authentication type for a particular zone to forms-based authentication from the Edit Authentication page in Central Administration.
This automatically changes the mode specified in the authentication element of the Web.config file for that zone to forms.
You will have to change the values specified for the server and groupContainer attributes to match your environment.
Register the HTTP module.
Not applicable
Web SSO with AD FS
The Microsoft Windows Server 2003 R2 operating system introduces Active Directory Federation Services (AD FS), which enables organizations to securely share a user's identity information. AD FS provides Web single sign-on (SSO) technologies to authenticate a user to multiple Web applications during a single online session.
The following two membership and role provider pairs are included with AD FS:
SingleSignOnMembershipProvider/SingleSignOnRoleProvider The standard membership provider and role provider included with Windows Server 2003 R2.
SingleSignOnMembershipProvider2/SingleSignOnRoleProvider2 The membership provider and role provider that operate in partial trust environments. These providers are included in Service Pack 2 of Windows Server 2003 R2.
If you are implementing the second AD FS provider set, the settings for registering the membership provider and role manager are different. The following table provides examples of Web.config file entries for a Web SSO AD FS environment that uses the provider that operates in partial trust environments.