SharePoint 2013 AD Active Security Group Issue

Question

We are facing an issue that is SharePoint 2013 user permissions. We added AD security group which contains all the users in SharePoint Visitor Group.

It was working fine. But now an interesting scenario is happening. Users in Visitor group reported that sometimes when they try to access the SharePoint site they got a message "Site is not shared with you". After sometime like 15 to 30 mins it start working again properly.

AD security group users who have contribute rights didn't face or reported this issue. this i s happening for Visitor group users only.

Anyone goes through this issue? Any ideas?

Answer 1

I personally had a few problems with AD Groups not long ago. I ended up finding a blog post about Security Token Caching.

Long story short, changes make in AD Groups weren't applied to the SharePoint site, at least not immediately, due to these token expiration delays.

Alternatively, an IISReset appeared to push all the changes immediately.

Not sure if this applies to you but I thought I'd share what happened to me.

Source

Similar Post:

Why are user permissions set in AD not updated immediately to SharePoint?

Answer 2

Since the issue is intermittent, I believe this is something related to object cache. In SharePoint Server 2013, querying for items is linked with the user account that makes the query. Various parts of the publishing feature make queries for which the results are cached in the object cache. The object cache makes its queries as one of two out-of-box user accounts: the Portal Super User and the Portal Super Reader. These user accounts must be properly configured to ensure that the object cache works correctly. Please ensure that you have configured them correctly in your environment.

Following article may help you for the required configuration:

Configure object cache user accounts by using Central Administration and Windows PowerShell

Hope it helps!!