SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have SharePoint 2010, on which each WebApplication have two zones - one Windows authentication and another is FBA via LDAP. The zone with FBA is allowed for anonymous access. Users are able to login with no problem in both zones.

Now, lets say I want on some web to take down anonymous access and give only to specifiec FBA users/roles access to it, by adding those FBA users/roles to SharePoint's group "Site Visitors". If I add user, then there is no problem - only this user is able to browse the web, however if I add role, none of he user from this role are able to access the web. Thye all got "Access Denied".

It seems like SharePoint fails to get roles for the FBA user and check whether this role has permissions to the web.

share|improve this question

Yes, role manager was configured. I managed to resolve it. The problem was in configuration of role manager in web.config of Security Token Service Application, "userNameAttribute" was not correct.

share|improve this answer

Did you also enable the role manager?

share|improve this answer

The problem is that the Role Provider doesn't know where the Users exist if you're Groups and Users reside in different OU's within AD.

Adding the userContainer= line that you have within your MemberProvider input to the RoleProvider in the web.configs will fix the issue.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.