If you are using Microsoft SQL Server database software on the local server as your membership provider database, and you specify AspNetSqlMembershipProvider for the membership provider name, you might not need to make any additional changes to the Web.config file. In this scenario, if the machine.config file has the correct configuration for the AspNetSqlMembershipProvider, you can use it for Windows SharePoint Services without making any changes.
If the default configuration in the machine.config file does not apply (for example, if you want to use a SQL Server database on a remote server), you must edit the Web.config files for both the Web application and the Central Administration Web site to specify the connection information in the connectionStrings element for the membership provider database.
Replace SQLSERVERMACHINE with the name of server computer on which you have installed the SQL Server membership database.
Next, add the membership and providers elements to register the membership provider in the Web.config file. Because a default provider is already registered in the machine.config file, you must include a <remove> element prior to the <add> element.
The preceding syntax uses the AspNetSqlRoleProvider, which is defined in the machine.config file. This role manager can connect to the ASPNETDB database in either the local or remote instance of SQL Server. If you want to use a SQL Server database on a remote server as your role provider database, you must edit the Web.config file to specify the connection information for the remote database server.
Replace SQLSERVERMACHINE with the name of the remote server that hosts the SQL database. You can specify the same connectionStringName element value for both the membership provider and role manager, so you do not need to add a new connectionStrings element for the role provider. However, if you want to use a different database for the role provider, you must add a separate connectionStrings element for the role provider.
Next, you need to add the roleManager and providers elements to register the roleManager provider in the Web.config. Because a default provider is already registered in the machine.config file, you must include a <remove> element prior to the <add> element.
<add connectionStringName="SqlProviderConnection" applicationName="/" description="Stores and retrieves roles data from the local Microsoft SQL Server database" name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
The roleManager element must be included within the system.web element of the Web.config file for both the Web application and the Central Administration Web site.
Register the HTTP module.
Active Directory membership provider
The following table provides examples of Web.config file entries for using ASP.NET forms authentication to use an Active Directory directory service membership provider.
This will only work in a scenario with a single domain.
Description and example Web.config file entries
Turn on ASP.NET forms authentication.
You can set the authentication type for a particular zone to forms authentication on the Edit Authentication page in Central Administration.
This automatically changes the mode specified in the authentication element of the Web.config file for that zone to forms.
If you want to use an Active Directory server for a membership provider, you must edit the Web.config file to register the membership provider. To do this, you must specify the connection information to the Active Directory server in the connectionStrings element.
The preceding example does not specify account credentials. If you do not specify account credentials, your application's process identity is used to access Active Directory.
If another account is required to access Active Directory, you can specify different account credentials in the connectionUsername and connectionPassword attributes, which means you are supplying the user name and password in plaintext. As a result, we recommend that you encrypt this configuration section. For more information, see the following articles:
You will need to change the values specified for the server and groupContainer attributes to match your environment.
Register the HTTP module.
Web SSO with AD FS
The Microsoft Windows Server 2003 R2 operating system introduces Active Directory Federation Services (AD FS), which enables organizations to securely share a user's identity information. AD FS provides Web single sign-on (SSO) technologies to authenticate a user to multiple Web applications during a single online session.
The following two membership and role provider pairs are included with AD FS:
SingleSignOnMembershipProvider/SingleSignOnRoleProvider The standard membership provider and role provider included with Windows Server 2003 R2.
SingleSignOnMembershipProvider2/SingleSignOnRoleProvider2 The membership provider and role provider that operate in partial trust environments. These providers are included in Service Pack 2 of Windows Server 2003 R2.
If you are implementing the second AD FS provider set, the settings for registering the membership provider and role manager are different. The following table provides examples of Web.config file entries for a Web SSO AD FS environment that uses the provider that operates in partial trust environments.