Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a SharePoint 2010 Foundation installation on Windows 2008 R2 and SQL Server 2008 and using Claims and Windows authentication.

Subsites are visible only to members of a certain group. However, when I add a user to the AD group that has access to a given subsite, the permissions for that user in SharePoint is not updated before the next day. So there is a mismatch between the permissions in AD and the ones in SharePoint.

For me, it seems like SharePoint is caching the permissions, and only updating them once every day. Is there a way to force a refresh so new permissions are loaded into SharePoint at once?

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Configure the Token Cache to a smaller value: http://technet.microsoft.com/en-us/library/cc287917(office.12).aspx. Default is 1440 minutes (24hrs)

share|improve this answer
    
Great tip! I will try that. –  azzlack Jun 18 '11 at 17:18
    
That worked beautifully. Thanks! –  azzlack Jun 23 '11 at 21:23
    
I tried this but it doesnt work for me. sharepoint.stackexchange.com/questions/70664/… –  Kannan Jun 17 '13 at 7:52
add comment

Original

This may due to the fact that Sharepoint imports the group membership information from Active Directory on a regular basis. the Frequency depends on configuration of your User Profile Synchronization service in central Admin. Profile synchronization is described nicely here: http://technet.microsoft.com/en-us/library/gg188041.aspx#groups

Updated Looking at comments below and carefully reading the link above, I think that AD Group membership is used for while Sharepoint compiled the target audiences. It is possible that even running profile synchronization does not solve your problem. Try using IISRESET /NOFORCE and see if it immediately detects AD changes (and clears the cache). I came across a long thread related to similar problem and I could not find a proper answer. Please share your experience and findings.

share|improve this answer
    
Great link Ashish! –  Neil Richards Jun 15 '11 at 20:20
    
I answered a similar question a couple days ago about access with AD groups and got downvoted. AD permissions are tied to the profile import. I want my 2 points back Anders! –  PirateEric Jun 15 '11 at 20:46
    
@PirateEric for once you cannot compare 2007 user profiles with 2010 since the architecture was changed completely with SP 2010 using FIM. Also read the article, it clearly states that groups are only used for Audiences, not authentication :-) –  Anders Rask Jun 15 '11 at 21:13
    
gpupdate /force seems to work as well. –  Colin Jun 16 '11 at 6:49
    
User Profile Synchronization is not available in Foundation, only Standard and Enterprise. Will try out the "iisreset /noforce" and "gpupdate /force" though. –  azzlack Jun 17 '11 at 6:53
show 2 more comments

Hope this will help someone because I faced the same issue. The claims based token is refreshed every 10 hours and hence if you make any changes to Active directory group memberships it won't reflect immediately in the token. you need to run the following powershell command to adjust the token life time to a smaller value.

$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime = (New-TimeSpan –minutes 60)
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 60)
$sts.Update()
Iisreset

It is explained in detail here http://www.shillier.com/archive/2010/10/25/authorization-failures-with-claims-based-authentication-in-sharepoint-2010.aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.