Users added programmatically can not authenticate

Question

I'm adding users programmatically to a SharePoint site. I'm doing this by adding the users domain login into the "[SiteName] Members" group. Unfortunately, users added this way are not able to authenticate to the site.

If I manually "Share" the site with a user (by typing their same domain login into the SharePoint control), the user is added to "[SiteName] Members" and can authenticate via Active Directory with no issue. In addition, users added via "Share" have "i:0#.w|" prefixed to their domain logins by SharePoint, while users added programmatically do not.

Does anyone know why users added programmatically via their domain logins are not able to authenticate?

Thanks for any help.

Solution:

using(var web = site.OpenWeb(webUrl))
{
    foreach(var userDef in usersToAdd)
    {
        //Use EnsureUser rather than AllUsers.Add()
        var user = web.EnsureUser(userDef.UserName);
        user.Email = userDef.Email;
        user.Name = userDef.Name;
        user.Notes = userDef.Notes;
        user.Update();
     }

    web.Update();
}

Answer 1

The prefix is a claims identity prefix:

i:0#w| =>
  i = identity
  # = user login name
  w = Windows

so this is a Windows Authentication Claims Identity, which is correct as long as you have configured Claims Authentication on the site.

Call SPWeb.EnsureUser() after you create the user object to add the user to the hidden User Information List for the site collection. Otherwise, the user identity will exist in the security group, but not in the User Information List, therefore causing the new identity to be unable to authenticate.