Take the 2-minute tour ×

I've setup FBA for SharePoint 2010 following these instructions: http://blogs.msdn.com/b/kaevans/archive/2010/07/09/sql-server-provider-for-claims-based-authentication-in-sharepoint-2010.aspx

It mostly works with one issue: I can't add FBA roles to SharePoint groups from Site Actions -> Site Settings -> People and groups. Here's what works:

  • In Central Admin add FBA user to web application's User Policy.
  • In Central Admin add FBA role to web application's User Policy.
  • In SharePoint Site Settings add FBA user to any SharePoint group for the site (Owners, Visitors, Members, etc.)

So it's just trying in SharePoint Site settings to add an FBA role to a SharePoint group that isn't working. For instance I want all FBA users that are in the FBAUsers role to be in the Visitors group for this site, but I can't add the FBAUsers role to the Visitors group. When I try it has the squiggly red underline and won't let me finish adding it.

Any tips on where/how to troubleshoot? I've retraced my steps, compared web.config settings with the instructions, and as far as I can tell I've followed it to the letter.

share|improve this question

2 Answers 2

You are doing everything correctly, and I can confirm that with the proper setup you are able to add roles to SharePoint groups. If you are getting the red underline, then most likely it is an issue with your web.config files:

Make sure that the RoleManager web.config entry is in your:

  • Application web.config
  • Central Admin Web.config
  • Secure Token Service web.config

Make sure that the default role manager in your web application's web.config is the SharePoint role manager (SPClaimsAuthRoleProvider).

Also make sure that your Role Manager Name for your SharePoint application (Central Admin - Web application Authentication Settings) matches your web.config.

Here is my entry for reference, you just need to change the name to match what you entered in your SharePoint application's Authentication Settings and change the connection name to match your membership provider's connection name.

<roleManager cacheRolesInCookie="false" defaultProvider="c" enabled="true">
    <add name="FBARoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" applicationName="/" connectionStringName="FBADB" />
    <add name="c" type="Microsoft.SharePoint.Administration.Claims.SPClaimsAuthRoleProvider, Microsoft.SharePoint, Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c" />

You can use the .Net Roles item in IIS to verify that the roles can be read. If you install the SharePoint 2010 FBA Pack (http://sharepoint2010fba.codeplex.com/) you can use the role manager it installs to validate the roles can be read.

share|improve this answer
Thanks for taking a look and providing some info. I was able to fix it per my answer. But also thanks for pointing me to your FBA Pack. I saw that in passing while troubleshooting this problem but didn't have a chance to look at it at the time. Looks like a great way to manage users, so I'll definitely give it a try. –  Yohan P Feb 29 '12 at 18:21
up vote 0 down vote accepted

After a lot of try-this-to-see-if-it-works troubleshooting, the problem was a SQL permissions issue.

The instructions at the link I mentioned in my original post says to give aspnet_Membership_BasicAccess and aspnet_Roles_BasicAccess roles to the account that the web application runs as, but when I gave that account those 2 roles as instructed it wasn't able to properly use People Picker to add roles. Further, the Lookup also didn't work for users (I could still add users by typing in the username then Check User button). Giving svcSPAppPool db_owner role on aspnetdb made everything work. It's probably overkill rights and I could make lesser rights work, but after days of troubleshooting at this point I'm content to leave it as is for now.

The author used Network Service for the web application account while I used a separate service account I created just for web applications (this is what I do on any typical SharePoint install) that I called svcSPAppPool. That probably had something to do with why adding the roles he mentioned didn't work for me. Further testing would prove/disprove this, but again I'm happy with how the setup is now so experimentation will have to wait another day.

share|improve this answer
Just a small question to your solution. Are you able to search for role groups in peoplepicker? I'm only able to search for users, not roles. However if I type the exact name of a role I'm able to add it to the sharepoint group. I have added the "FBAroles" and "FBAmember" in the PeoplePickerWildcards in the web.config files. Thank you –  user7275 Mar 8 '12 at 14:40
Jan, sorry for the late response--the notification in the top bar needs to be bigger :) I'm getting the same thing as you. I can do partial match searches on usernames but not roles. I don't know if there's a further step that would enable partial search on roles, but since I have so few roles it's not a big deal for me. Sorry I couldn't provide more info. –  Yohan P Apr 10 '12 at 4:00

Your Answer


