How do I add an AD account to a sharepoint group from a different (non-sharepoint server)

Question

For reasons beyond my control, I have to run our e-commerce on a non-sharepoint server. I can easily create an AD account and have no problems there.

Now, on a different box, I need to add the account to an existing Sharepoint group.

If they were running as different virtual servers on the same box, it's as simple as making a system call to stsadm.exe

eg:

C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\stsadm.exe -o adduser -URL http://Sharepoint.mydomain.com/site/ -userlogin MYDOMAIN.COM\Accountname -useremail [email protected] -group SITE-VISITORS -username "Name, Account"

The obvious extension of this technique is to make a system call to PSExec, and do the same thing. It works, but seems to barf occasionally, making it an unreliable method.

Everything is running on the same domain, and the servers are physically near each other. One solution, though inelegant, would be to append the commands to a batch file, and periodically run the batch.

Has anyone solved this issue? How did you do it?

Answer 1

Why not just create an AD group called something like 'MYDOMAIN\eCommerceBuyers'. Grant that group the desired permissions in SharePoint and then on the eCommerce side, simply add the users to the 'MYDOMAIN\eCommerceBuyers' domain group?

That bypasses the need for the two systems to communicate at all and lets you centrally manage membership outside of either system.