Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an ssl web app with default and internet authentication providers. The default zone is setup to use windows authentication type. I've setup the internet zone to use forms. I'm using Active Directory for my provider. When I try to sign in with a site collection administrator, I get an access denied error that states "you are currently logged in as: user". It's hitting active directory and seeing I'm a legit user, but then it's saying I don't have rights for the site, even though I double/triple check that it's the site admin.

My googling skills are not sufficient for solving this one. Any suggestions?

In case I flubbed the web.config, here's what I have for the site and central administration:

    <add name="ADConnectionString" 

    <membership defaultProvider="ADProvider">
        <add name="ADProvider" 
           System.Web, Version=, Culture=neutral, 
           connectionUsername="user" connectionPassword="password" 
           attributeMapUsername="SAMAccountName" />
share|improve this question
up vote 1 down vote accepted


Even though you're logging in with the site admin account, there isn't account equivalence between zones due to the difference in authentication providers -- even though they have the same backing store (AD).

To get yourself in through your FBA-extended Internet zone to do the work you'll need, I'd recommend setting up a full-access web policy for your admin account:

  1. Go into Central Admin
  2. Navigate to Application Management > Policy for Web Application
  3. Select Add Users
  4. Make sure the desired web application is selected (upper right)
  5. Select the Internet zone (at a minimum) or (All zones).
  6. Specify your account and give it Full Control
  7. Hit Finish

This approach is commonly needed when you first extend a site to a different backing membership store or leverage a new auth provider. The rights granted through a web application policy supersede any that might be specified in the site collection (if there is a conflict) and give you the first entry point into the desired site collection if no other account/mapping has valid access.

I hope this helps!

share|improve this answer
Thanks Sean, I'm trying that now. – Becky Sep 21 '09 at 16:55
I appreciate the clear directions, but that didn't solve my issue. I already had a user with full control over all zones, but I thought I'd walk through the steps anyway, in case there was somewhere I erred. – Becky Sep 21 '09 at 17:05
Another thought, Becky, came to mind when reading your comment: did you extend the central administration site with the additional provider information before granting the admin user full control? Though the admin account/user that you need to add (and grant full control to) already has a policy set, I believe you need to setup a second policy that will cover logins through the FBA provider (since username formats differ). To do this, you need to modify the central admin web.config with the additional provider info (which you have) and create a policy using the FBA-based username. – Sean McDonough Sep 21 '09 at 17:29
I believe the reason for this is because there isn't equivalence between the FBA username (which is probably something like "MyUserName") and the standard NTLM-based logon username (which is something like "MyDomain\MyUserName"). Make sense? – Sean McDonough Sep 21 '09 at 17:31
Thanks for all your help, it is now working. – Becky Sep 21 '09 at 19:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.