I guess this is very specific so might be hard to find someone who has a clue - but it's worth trying.
I have a simple console app in c# that adds AD groups to existing SP security groups using REST api. What it does it only POSTs to following url: /_api/web/sitegroups(x)/users
(it also includes a form digest value in X-RequestDigest
header).
This works fine in my company's environment. This also works on one test site in the client's environment, but in all other sites a WebException is thrown with this error:
401 Unauthorized and inside there is a message: "Access denied. You do not have permission to perform this action or access this resource”.
What's even more interesting: the group is added successfully! Why is the exception thrown then...?
This is very strange as the user that is running the tool can access those sites and can add users to those groups via browser. He has full permissions on those sites. What's happening?