Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I'm running into an issue with some site collections in a SharePoint 2010 web application. After migrating to claims, there are a couple site collections that give Access Denied, even to users that have been set as site collection administrators or given full control through central admin user policy.

Our default zone is running NTLM and the web app has been extended to add one that supports both NTLM and Forms-based authentication. Users can log in find using both NTLM and forms.

I've tried re-running MigrateUsers on the web application and verified that users have been converted to their claims ids.

Users have no problem logging in and accessing other site collections, but these sites consistently give Access Denied, no matter which user attempts to access them.

share|improve this question

2 Answers 2

Have you verified that the portalsuperuseraccount and portalsuperreaderaccount properties of the web application are set to Claims-based account names? If they were set before the migration, they may still exist in a non-Claims encoded format.

You can update these values through PowerShell:

$wa.Properties["portalsuperuseraccount"] = "i:0#.w|domain\apppool"
$wa.Properties["portalsuperreaderaccount"] = "i:0#.w|domain\apppool"
$wa.Update()
share|improve this answer
    
I found that it was indeed related to the object cache, however the usernames were set to claims-based. The users also had proper access policy. I set the accounts back to the default, which seemed to disable the object cache for now (though I do get event log items complaining about the accounts not being configured) and everything is back to working properly. –  markt Jun 16 '11 at 0:02
    
@markt: If Danny's answer solved your problem, you should mark it as the correct answer. :) –  Kit Menke Aug 14 '11 at 17:31
    
@kit - it didn't solve my problem, and so I have not marked any answer as correct yet. ideally I would like the object cache to work. –  markt Aug 19 '11 at 23:34

Also, do these site collection access data / lists from other site collections that don't have Claims enabled? if 1 webpart throws an access denied on your homepage for instance, the entire page will be inaccessible. Can they access the _layouts/viewlsts.aspx page?

P.S., the Search App probably needs to have Claims enabled as well:

$searchapp = Get-SPEnterpriseSearchServiceApplication
$searchapp.SetProperty("ForceClaimACLs",1)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.