Access Denied on Site Collection after Migrating to Claims

Question

I'm running into an issue with some site collections in a SharePoint 2010 web application. After migrating to claims, there are a couple site collections that give Access Denied, even to users that have been set as site collection administrators or given full control through central admin user policy.

Our default zone is running NTLM and the web app has been extended to add one that supports both NTLM and Forms-based authentication. Users can log in find using both NTLM and forms.

I've tried re-running MigrateUsers on the web application and verified that users have been converted to their claims ids.

Users have no problem logging in and accessing other site collections, but these sites consistently give Access Denied, no matter which user attempts to access them.

Answer 1

Have you verified that the portalsuperuseraccount and portalsuperreaderaccount properties of the web application are set to Claims-based account names? If they were set before the migration, they may still exist in a non-Claims encoded format.

You can update these values through PowerShell:

$wa.Properties["portalsuperuseraccount"] = "i:0#.w|domain\apppool"
$wa.Properties["portalsuperreaderaccount"] = "i:0#.w|domain\apppool"
$wa.Update()

Answer 2

Also, do these site collection access data / lists from other site collections that don't have Claims enabled? if 1 webpart throws an access denied on your homepage for instance, the entire page will be inaccessible. Can they access the _layouts/viewlsts.aspx page?

P.S., the Search App probably needs to have Claims enabled as well:

$searchapp = Get-SPEnterpriseSearchServiceApplication
$searchapp.SetProperty("ForceClaimACLs",1)