SharePoint 2010 - Claims Based Authentication - Access Denied for AD Group members

Question

We're in the process of migrating our SharePoint 2003 system to 2010 and have used Metavis to migrate the data. We had to do the data migration in a lab environment and then move/attach the content database to our production server. The database attached successfully and I, as a site collection administrator, can see all sites and the data therein. We are using claims-based auth with ADFS 2.0 as the provider.

My users, however, get access denied trying to go anywhere on the site. I have added the Active Directory groups to the appropriate SharePoint groups and have confirmed the groups are appearing with the c:0-.t|adfs|group_name syntax. If I add them as individual users (i:05.t|adfs|[email protected]) they can authenticate fine, but not by AD group membership.

I enabled ADFS tracing and I see that the claim being provided includes the SIDs for all the groups the user belongs to. Using ULS Viewer I can see that SharePoint sees the correct number of claims (it doesn't show what those claims are, just the number) but it doesn't seem to be connecting the SIDs passed to the group name used in the permissions list. I have also updated the portalsuperreader and portalsuperuser accounts after the database was moved, just in case there was something weird there.

The ADFS and SharePoint servers are all in the same AD domain, so they should be able to resolve SIDs ok. I suspect the issue is somehow related to the migration of the content database from a separate environment (different domain), but I can't figure out for the life of me how to get the group authentication to work.

Thoughts?

Answer 1

Resolved: As it turned out, the Windows groups were Domain Local groups. We only have a single forest/single domain, so I'm not sure why it mattered, but once we changed them to either Universal or Global groups, Sharepoint was able to resolve membership.