I'm using SharePoint 2016 on-prem with ADFS.

I configured the token issuer to use the default configuration. When I authenticate myself in Firefox and view the claims that have been passed, I can see group memberships in the wresult params, so I feel confident the configuration is correct. I have actually tried setting the Token Groups to both unqualified and Domain Name (but not fully qualified). Neither works.

If I give permissions to an individual for a SharePoint object, those permissions work correctly; however, if I try to assign the same permissions to a group that that user belongs to (and then remove the individual user), those permissions are not propagated. The user is still authenticated and has access from the NT Authority\Authenticated Users group, but nothing else.

I have changed the token configuration settings so that the cache is refreshed in 10 minutes (instead of 10 hours), and the token lifetime is the same.

People picker shows the groups.

I've tried selecting the correct (for our site) membership groups from AD in the User Profile Sync settings, and also just selecting the entire OU. Nothing seems to work.

Is there some sort of hidden setting that Microsoft doesn't talk about to allow group membership to pass from AD through ADFS to SharePoint?

BTW, I'm trying to stay away from using a third-party claim provider (such as LDAPCP, of which I'm aware) b/c of network requirements. That's why I used the default configuration when I set up the token issuer.

Also, my SharePoint is on a separate network, so I can't really copy and paste anything. (I know that's going to be a request for some; sorry!)

Thanks for the help.

  • For anyone interested in solving this issue: I put in a call to Microsoft and received the answer. In ADFS, set one of the outgoing claim values in the Relying Party Trust to "Token Groups - Group SIDs" with the value type as Group SID, then configure the trust issuer to accept a Group SID instead of a role. – P B Jan 28 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.