0

I have a WCF REST service running in SP2013 that is used to determine which SP groups a given user is in (this is called by provider hosted apps, who can't get the relevant info from the CSOM).

The SP groups I am interested in have AD groups as members, and I need to be able to see these indirect memberships (i.e. Bob is a member of AD group ADStaff and ADStaff is a member of SP group SPStaff. I need to see Bob is a member of SPStaff).

The vast majority of the time the solution works correctly, but every day or so one or two users will be reported as not having access to one of the relevant groups. This lasts for a couple of minutes then comes right. During this time they are still reported as having access to other groups which were granted to "Everyone". Our AD administrator says nothing's going on at their end. Can anyone suggest what may be going wrong?

    public Model.IdentityData Get(string webUrl, string userName)
    {
            ...
            SPUserToken userToken = GetUserToken(webUrl, userName);

            return GetModel(webUrl, userToken);
            ...
    }

    private SPUserToken GetUserToken(string webUrl, string userName)
    {
            ...
            using (SPSite site = new SPSite(webUrl))
            {

                using (SPWeb web = site.OpenWeb())
                {
                    SPUser user = web.AllUsers.Cast<SPUser>().FirstOrDefault(u => u.LoginName.Equals("i:0#.w|" + userName, StringComparison.OrdinalIgnoreCase));

                    ...

                    return user.UserToken;
                }
            }
            ...
    }

    private static Model.IdentityData GetModel(string webUrl, SPUserToken userToken)
    {
        using (SPSite site = new SPSite(webUrl, userToken))
        {
            using (SPWeb web = site.OpenWeb())
            {
                SPUser user = web.CurrentUser;

                var groups = new List<string>();
                foreach (SPGroup group in web.Groups)
                    if (group.ContainsCurrentUser)
                        groups.Add(group.LoginName);

                return new Model.IdentityData()
                {
                    LoginName = user.LoginName,
                    DisplayName = user.Name,
                    EmailAddress = user.Email,
                    Groups = groups
                };
            };
        }
    }

1 Answer 1

0

Answering (sort of) in case anyone else runs into the issue. After putting in some extra diagnostics it appears the problem occurs when the user has not visited SharePoint for a number of hours. My hypothesis is that SharePoint only knows that a user has indirect membership of an SP group if it has a cached token for them. Once their token is flushed out of the cache it can't resolve their indirect memberships.

If anyone can confirm or refute this, or (assuming I am correct) supply a way to force SP to refresh the user's token, I would be interested to hear it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.