0

Here follows the scenario: SharePoint 2013 on premises, forms authentication enabled and working against three providers: two ADs and one SQL

Our users are able to authenticate against the site, people-picker find both users (from ADs and SQL) and AD groups. However, if we give permissions through AD Security Groups, the users report the site were not shared with them.

Bellow is the web.config role manager configuration

<add name="FB_Role" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="desenv.fb.org.br" port="389" useSSL="false" groupContainer="DC=desenv,DC=fb,DC=org,DC=br" groupNameAttribute="cn" groupNameAlternateSearchAttribute="samAccountName" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" userFilter="(ObjectClass=person)" scope="Subtree" />
<add name="EDU_Role" type="Microsoft.Office.Server.Security.LdapRoleProvider, Microsoft.Office.Server, Version=15.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" server="desenvedu.fb.org.br" port="389" useSSL="false" groupContainer="DC=desenvedu,DC=fb,DC=org,DC=br" groupNameAttribute="cn" groupNameAlternateSearchAttribute="samAccountName" groupMemberAttribute="member" userNameAttribute="sAMAccountName" dnAttribute="distinguishedName" groupFilter="(ObjectClass=group)" userFilter="(ObjectClass=person)" scope="Subtree" />

We tried changing the FormsTokenLifeTime and profile sync but still no success and we are still unable to give permissions through AD groups. Any ideas ?

  • Your server= and groupContainer attributes differ for the first part of the FQDN. Is this intentional? As an aside, it's generally better and easier to maintain a pre-auth FBA service in front of SharePoint, such as WAP + ADFS, rather than configure FBA directly on SharePoint. – Trevor Seward Jul 18 '17 at 15:14
  • those are different domains. In our case, we have domain desenv.fb.org.br and desenvedu.fb.org.br. In our cenario, we need to authenticate users agains both domains and also SQL users in the same web app, thats why we considered configuring an FBA. In your described cenario, how the authentication and authorization will work ? (I'll do some research about it but would appreciate more information) – Pablo Bertrão Jul 18 '17 at 17:09
  • I misread it, sorry. What I would do is look for PermissionMask errors in the ULS log. – Trevor Seward Jul 19 '17 at 14:54
0

After consulting Microsoft, we were asked to install the cumulative update from may 2017 to solve our problem, since it was a SharePoint issue from our version (april 2015 CU)

We installed the below update and it worked. Hope it helps.

https://support.microsoft.com/en-us/help/3191913/may-9-2017-cumulative-update-for-sharepoint-server-2013-kb3191913

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.