We are facing in our sharepoint farm "sporadic" access denied issue due to our cache accounts in a claims (with ADFS) setup.
cache reader & cache full access are configured as expected at webapp policy level & property bag one. moreover, we had them in the local administrator group.
end users get an access denied ("sorry, you don't have access to this page") due to underlying issue to resolve the cache account.
We are getting the "normal" cache message
SPRequest.GetMetadataForUrl: UserPrincipalName=i:0).w|s-1-5-21-2438373579-171170487-1684575306-43097, AppPrincipalName= ,bstrUrl=/sites/searchcenter/Cache Profiles ,METADATAFLAGS=59
and here I'm a little bit surprised about the form of the UPN, the SID is the one of the cache account, UPN attribute is filled in AD. (I would have expected to see the name resolved) and I'm especially surprised regard the ")" in the claims prefix which doesn't mean anything (at least for me). Does anybody know what it's refering to ?
Reference : How Claims encoding works in SharePoint
sharepoint version : 15.0.4675.1000 / ADFS 3.0