0

Here follows the scenario: SharePoint 2013 on premises, forms authentication enabled and working against three providers: two ADs and one SQL

Our users are able to authenticate against the site, people-picker find both users (from ADs and SQL) and AD groups. However, if we give permissions through AD Security Groups, the users report the site were not shared with them.

Bellow is the web.config role manager configuration

<add name="FB_Role" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="desenv.fb.org.br" port="389" useSSL="false" groupContainer="DC=desenv,DC=fb,DC=org,DC=br" groupNameAttribute="cn" groupNameAlternateSearchAttribute="samAccountName" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" userFilter="(ObjectClass=person)" scope="Subtree" />
<add name="EDU_Role" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="desenvedu.fb.org.br" port="389" useSSL="false" groupContainer="DC=desenvedu,DC=fb,DC=org,DC=br" groupNameAttribute="cn" groupNameAlternateSearchAttribute="samAccountName" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" userFilter="(ObjectClass=person)" scope="Subtree" />

We tried changing the FormsTokenLifeTime and profile sync but still no success and we are still unable to give permissions through AD groups. Any ideas ?

Improve this question
3
  • Your server= and groupContainer attributes differ for the first part of the FQDN. Is this intentional? As an aside, it's generally better and easier to maintain a pre-auth FBA service in front of SharePoint, such as WAP + ADFS, rather than configure FBA directly on SharePoint.
    – user6024
    Commented Jul 18, 2017 at 15:14
  • those are different domains. In our case, we have domain desenv.fb.org.br and desenvedu.fb.org.br. In our cenario, we need to authenticate users agains both domains and also SQL users in the same web app, thats why we considered configuring an FBA. In your described cenario, how the authentication and authorization will work ? (I'll do some research about it but would appreciate more information)
    – Pablo Bertrão
    Commented Jul 18, 2017 at 17:09
  • I misread it, sorry. What I would do is look for PermissionMask errors in the ULS log.
    – user6024
    Commented Jul 19, 2017 at 14:54

1 Answer 1

Reset to default
0

After consulting Microsoft, we were asked to install the cumulative update from may 2017 to solve our problem, since it was a SharePoint issue from our version (april 2015 CU)

We installed the below update and it worked. Hope it helps.

https://support.microsoft.com/en-us/help/3191913/may-9-2017-cumulative-update-for-sharepoint-server-2013-kb3191913

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.