This claims provider queries Active Directory or any LDAP to add search capabilities to the people picker in trusted authentication (typically ADFS).
![Joe boss]( "Joe boss")
Features
It is highly customizable through administration pages added in Central administration/Security:
- Works with SharePoint 2013 and SharePoint 2016 RC.
- Connect to multiple LDAP / AD in parallel (multi-threaded requests).
- Customize display of permissions.
- Populate properties of users when they are added from the people picker.
- Customize list of claim types, and their mapping with LDAP attributes.
- Set custom LDAP filters for specific claim types, e.g. to only return users that are member of a specific security group.
- Set a keyword to bypass LDAP lookup. e.g. input "extuser:partner@contoso.com" directly creates permission "partner@contoso.com" on claim type set for this.
- Set a prefix to add to LDAP results, e.g. add "domain\" to groups returned by LDAP.
- Supports rehydration for provider hosted apps.
Important - Limitations
Due to limitations of SharePoint API,do not associate LDAPCP with more than 1 SPTrustedIdentityTokenIssuer. Developers can bypass this limitation by inheriting LDAPCP to create new claims providers (with different names). Read “Developers section” below for further information.
If a SharePoint server does not have SharePoint service “Microsoft SharePoint Foundation Web Application” started, ldapcp.dll assembly will not be deployed in its GAC. In that case, you must manually add it
or some features may not work. In SharePoint 2013 (.NET 4.5), the GAC is located in C:\Windows\Microsoft.NET\assembly.
Version 2 is a critical update that
ensures thread safety and fully implements SharePoint logging infrastructure (messages are recorded in Area/Product "LDAPCP"). Its logging level can be customized with PowerShell or Central Administration.
How to install LDAPCP
Install and deploy the solution (that will automatically activate the “LDAPCP” farm-scoped feature):
Add-SPSolution -LiteralPath "PATH TO WSP FILE"
Install-SPSolution -Identity "LDAPCP.wsp"-GACDeployment
At this point claim provider is inactive and it must be associated to an SPTrustedIdentityTokenIssuer to work:
$trust = Get-SPTrustedIdentityTokenIssuer "SPTRUST NAME"$trust.ClaimProviderName ="LDAPCP"$trust.Update()
How to update LDAPCP
Run Update-SPSolution cmdlet to start a timer job that that will deploy the update. You can monitor the progression in farm solutions page in central administration.
Update-SPSolution -GACDeployment -Identity "LDAPCP.wsp" -LiteralPath "C:\Data\Dev\LDAPCP.wsp"
How to remove LDAPCP
For an unknown reason, randomly SharePoint 2013 doesn’t uninstall correctly the solution because it removes assembly from the GAC before calling the feature receiver... When this happens, the claims
provider is not removed and that causes issues when you re-install it.
To uninstall safely, deactivate the farm feature before retracting the solution:
Disable-SPFeature -identity "LDAPCP"
Uninstall-SPSolution -Identity "LDAPCP.wsp"
Remove-SPSolution -Identity "LDAPCP.wsp"
Validate that claims provider was removed: "Get-SPClaimProvider| ft DisplayName". If LDAPCP appears, remove it: "Remove-SPClaimProvider LDAPCP"
Claims supported
LDAPCP has a default mapping between claim types and LDAP attributes, but this can be customized in “Claims table” page available in Central Administration/Security.
Default list is following:
| Claim type | LDAP attribute name | LDAP object class |
|---|
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress | mail | user |
| http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname | sAMAccountName | user |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn | userPrincipalName | user |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname | givenName | user |
| http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality | physicalDeliveryOfficeName | user |
| http://schemas.microsoft.com/ws/2008/06/identity/claims/role | sAMAccountName | group |
| linked to identity claim | displayName | user |
| linked to identity claim | cn | user |
| linked to identity claim | sn | user |
None of the claim types above is mandatory in the SPTrust, but the identity claim must either be one of them, or added through LDAPCP admin pages.
Note that you should never have 2 identical claim types in the list, this would cause issues.
To enhance search experience, LDAPCP also queries user input against common LDAP attributes such as the display name (displayName) and the common name (cn).
Developers corner
Project has evolved a lot since the beginning, and now 99% of all possible customizations can be made with LDAPCP administration pages in standard solution. Possible customizations not covered by standard package
that can be achieved with "LDAPCP for Developers.zip" are:
- Use LDAPCP in multiple trusts (SPTrustedIdentityTokenIssuer objects), so that each trust has a claim provider with a unique name.
- Customize the display text or the value of permissions created by LDAPCP
"LDAPCP for Developers.zip" contains a Visual Studio project with sample classes that cover various use-case scenarios. Only 1 inherited claim provider is installed at a time, you need to edit the feature event
receiver to install the claim provider you want to test.
Common mistakes to avoid:
- Always deactivate the farm feature before retracting the solution (see "how to remove" above to understand why).
- When you create your own SharePoint solution, DO NOT forget to include the ldapcp.dll assembly in the wsp package.
If you did any of the mistakes above, you will likely experience issues when you try to redeploy the solution because the feature was already installed. All features in the solution must be uninstalled before
it can be redeployed.
In any case, DO NOT directly edit LDAPCP class, it has been designed to be inherited so that you can customize it to fit your needs. If a scenario that you need is not covered, please submit it in the discussions
tab.