Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an existing FBA database of ~2000 users for one of my clients in WSS 3.0.

I have successfully upgraded their WSS site collection (in a test environment) to SharePoint 2010.

I have also configured the 2010 installation to use FBA (through Claims Based Authentication) and verified that the users can be seen from the site collection.

The problem arrises in the way that the Security Token Service (STS) hands user info to SharePoint compared to the old way; the user token from STS does not match the format of the users that already exist in the site collection and they get "Access Denied."

For instance, In the Site Collection, the user EtherDragon is referred to as "fbamembership:etherdragon" However, the STS refers to me as "0.f|fbamembership|etherdragon" which has no perms.

Is there an good way to either get STS to use the old format or map current site collection users to their STS equivalent?

What I would like to avoid, if possible, is having to remove and re-add ~2000 users from their groups in SharePoint.

share|improve this question
up vote 0 down vote accepted

I ended up building a user remove/replace web part, which makes this more of a StackOverflow solution. Check out the Blog at

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.