SharePoint 2016 ADFS authentication, people picker shows AD users and AD group, permissions dont work for AD groups

Question

We are using SharePoint 2016 and ADFS authentication. In AD we have users and groups. In SharePoint it is possible to resolve users and groups from AD. When you share a document to an AD user it is working fine. When you share a document to an AD group, the AD users inside this AD group dont have acces. What is going wrong? Please help.

UPDATE

We are using global and universal AD security groups. In ADFS 2016 we have at this moment 1 "Send LDAP Attributes as Claims" rule with 1 mapping "UPN". Do I need to add more mappings?

Answer 1

There are lot of configurations you are missing and will try to explain briefly.

1. You will need to configure ADFS to send out role claims i.e claims representing the groups the current user is a member of. There are several ways to do it and it depends on what value you want to be sent as part of role claim (like DN, sid, group name).

Map the attribute 'Token-Groups – Unqualified Names' to an outgoing claim 'role' on ADFS. See this example.

2. Then add the claim to the new claim to SharePoint.

   Get-SPTrustedIdentityProvider -Name "Name of the provider" | Add-SPClaimTypeMapping -IncomingClaimType "http://schemas.micsoroft.com/ws/2008/06/identity/claims/role" -IncomingClaimTypeDisplayName "Role" -LocalClaimType "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"

3. You will then need to install and configure the claims provider. This claims provider is going to augement claims in the people picker and will be configured use role claims when AD group is selected. A popular claims provider is LDAPCP which is commonly used with ADFS.

Now when you share a document to an ad group the appropriate claims will be added to the object permissions. When user the logins ADFS will issue claims that should match the claims configured on the site.

Answer 2

What kind of group are you granting permissions to?

Is it a "Domain local" group? If so you need to manually configure ADFS to include them in the claims.

Alternative is to check the actual SAML token fot the user. You can do that by examining the User table or taking a F12 Trace of the logon (For a fiddler trace you might have to disable the secure channel setting on the ADFS Server)

Long story short: Check with the ADFS team if they include the Groups in your SAML claim.

P.s.: You should not use ADFS against your own domain. It will cause various issues. ADFS is designed to be used with a foreign domain. There is no communication between SP and the ADFS Server. This can cause several issues as the one you mentioned. Another issue you will run into is the inability to search file shares.

Edit: Yes, it looks like you are not sending any groups.

Have a look here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-rule-to-send-group-membership-as-a-claim

Answer 3

Create your AD groups in AD like this in picture.

Then in Sharepoint create groups (_layouts/15/groups.aspx) and add that AD group.

SP Group 1 > AD group 1

Then you share a document to an SP Group 1 and Sharepoint will resolve users from AD security group.