Relation between an FBA Role and SharePoint Group

Question

I have worked with FBA Membership using SQL.

Once we add a Membership User, we can create an equivalent SPUser in SharePoint. But I am not sure how I can establish that kind of a relationship between an FBA role and a SharePoint security Group?

Whenever I create an FBA role in the SQL DB, should I create an equivalent group in SharePoint?

But, there is another question also here, I have to give custom permissions to the Role. How do they get translated into SharePoint? I am not getting a clear picture of all this.

Does anyone have any links / articles / blogs / videos which explains these things in detail?

Answer 1

If, at first, we don't consider whether members and groups come from the AD or FBA, here's what happens:

1. You can grant direct SharePoint permissions to users. This translates as an SPUser in SP.
2. You can grant direct SharePoint permissions to AD security groups (aka FBA roles). This also translates as an SPUser in SP (but with SPUser.IsDomainGroup set to true this time)!
3. You can create SharePoint groups in SharePoint. SP groups are completely non-related to security groups/roles. Think of them as "application" groups, opposed to AD/FBA groups that are "organizational" groups. SharePoint groups translate as SPGroup in the object model.
4. SharePoint groups can contain either users or AD security groups (FBA roles).
5. You can grant SharePoint permissions to SharePoint groups.
6. Usually, the best practice to assign permissions, is to create SP groups, add AD groups (or maybe, also, users) as members of this SP group, and assign permissions to the SP group.

You FBA member/role provider only switches the management of users/security groups from the AD to your custom DB.

Answer 2

Go through the below links,

Understanding SharePoint Groups: https://support.office.com/en-us/article/Understanding-SharePoint-groups-94d9b261-161e-4ace-829e-eca1c8cd2eb8

Understanding SharePoint permission levels: https://support.office.com/en-us/article/Understanding-permission-levels-87ecbb0e-6550-491a-8826-c075e4859848

How to create ShrePoint permission levels: https://support.office.com/en-us/article/How-to-create-and-edit-Permission-Levels-53c86040-07fa-4ea7-bc55-34ee96b437fe

How to grant permission: https://support.office.com/en-us/article/Roadmap-Grant-permissions-for-a-site-10682af5-e6f2-4176-96ab-d990ad143ade#__toc256514300