Initiate workflow on SharePoint 2013 when initiator is granted access only through Active Directory group

Question

Has anyone successfully achieved the following:

1. Using SharePoint 2013, in the browser, create a custom list or library

2. Grant Full Access or Contribute access to this list or library for an Active Directory security group (not to individuals or SharePoint groups).

3. Add a workflow to this list using SharePoint Designer (set to initiate on the creation of a new item). If you have done this same series of steps but used Visual Studio to build the workflow I'd like to know if you had success as well. I haven't tried VS yet.

4. Have a user who is only a member of the Active Directory group (not someone with additional rights on the site) add a new list item.

5. The workflow begins.

   I have tried this however the Workflow just does not start. No errors. It's just as though the workflow does not exist.

This seems to be critical functionality but I can't find anyone who has made it work.

Note: If I grant the same user direct permissions to the list the workflow initates and completes successfully, so this is not an issue with the workflow itself. Repeating the same steps using a 2010 Workflow (within SharePoint 2013) does not have this problem.

I have heard similar reports online but am trying to determine if this is a bug.

Thanks, Maureen

Answer 1

UPDATED: June 22, 2016: So I know this thread is old and I know that the last update has been a while ago, but I also know it is still showing up when people are dealing with this problem so I wanted to post an answer that worked for us.

We had the exact same problem. All of our settings in UPS were correct. We had the correct active directory OUs selected and were syncing groups and users. But for some reason, none of our groups were working. The problem was finally determined that UPS was in fact pulling groups in, but it wasn't pulling them in from the OUs we had selected. It only pulled in groups within the Users OU. We had also selected a separate OU that contains all the Groups used exclusively for SharePoint. To fix it, we de-selected the SharePoint OU and then re-selected it. Re-ran a full sync and the groups started populating in the database.

More details can be found here: http://prairiedeveloper.com/2016/06/sharepoint-2013-workflow-failing-immediately-starting/

Hope this helps others.

**** END UPDATE ****

In case anyone comes across this still looking for an answer, I don't know if there yet is one. I believe the issue has to do with the WF Manager and being able to read into the groups contained within the list. Because SP 2010 WF are contained withing the SharePoint foundation, there isn't an extra authentication step that the WF Manager has to make.

Some have claimed that putting the groups at the root of the domain (not in nested OUs) can fix the problem. Another user has claimed that he was able to fix by ensuring his UPS sync was going both ways for groups and users (though I am pretty sure many have tried this).

I would like to say I have the answer, but as of the writing of this (nearly 6 months after Maureen posted it) I still suffer from this and believe others do as well. If someone has a solution I would love to try it out.

You can find a large troubleshooting thread on this here: https://social.technet.microsoft.com/Forums/sharepoint/en-US/507f40c3-8871-4151-a038-69665f64f63c/sharepoint-2013-workflow-permission?forum=sharepointgeneral