LdapRoleProvider Problem in SharePoint FBA

Question

I have a question regarding SharePoint FBA with LDAP against AD.

Currently, I have configured LDAP with LdapMembershipProvider (AD) and LdapRoleProvider (ldaprole) in SharePoint with the following config

<membership defaultProvider="AD">
      <providers>
        <add name="AD" type="Microsoft.Office.Server.Security.LDAPMembershipProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" server="[servername]" port="389" useSSL="false" userDNAttribute="distinguishedName" userNameAttribute="sAMAccountName" userContainer="DC=group,DC=company,DC=local" userObjectClass="person" userFilter="(|(ObjectCategory=group)(ObjectClass=person))" scope="Subtree" otherRequiredUserAttributes="sn,givenname,cn" />
      </providers>
    </membership>
    <roleManager defaultProvider="Ldap" enabled="true" cacheRolesInCookie="true" cookieName=".PeopleDCRole">
      <providers>
        <add name="Ldap" type="Microsoft.Office.Server.Security.LDAPRoleProvider, Microsoft.Office.Server, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" server="[servername]" port="389" useSSL="false" userContainer="DC=aagroup,DC=redicons,DC=local" groupContainer="DC=group,DC=company,DC=local" groupNameAttribute="cn" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" scope="Subtree" />
      </providers>
    </roleManager>

I am able to get the users in AD with

AD:user1
AD:user2

but I am not able to obtain the group with ldaprole, it returns nothing. However, the group can be located with AD (ldapmembershipprovider) instead. The groups are in the same OU with users in AD.

AD:group1
AD:group2

Thus, how could i get the ldaprole:group1 instead, because it will be used for the authentication in my sharepoint site? Also included:

<PeoplePickerWildcards>
      <clear />
      <add key="AspNetSqlMembershipProvider" value="%" />
    <add key="Ldap" value="*" />
    <add key="AD" value="*" />  
</PeoplePickerWildcards>

Answer 1

Where do you search for the users and roles?

Have you already set up providers for both application web.config and Central Administration web.config?

To be able to grant users access through Policy for WebApplication in Central Administration > Applications you need to set up membershipprovider in CA as well, and add AspNetWindowsTokenRoleProvider as default role provider for CA (since CA still uses windows auth for roles). Note: policies should only be used to grant access to an FBA admin to allow him to log on to your FBA zone.

Also note that you cannot search with wildcard for groups when you use FBA, that works for windows groups only (this is due to lacking support for this in role providers). Hence if you search for AD:group you wount get any hits.

Answer 2

Anders, you are correct. The group name CANNOT be located with wildcard search.

After adding the ldaprole:group1 to the User Groups, i still need to configure the "Policy for Web Application" by setting

NT authority\local service to have Full Read Permission.

Then the users in the AD groups are well-authenticated.

Thanks for your help.