cannot add External Domain User To Group

Question

I have a problem about adding a User to Group using a custom code (web part / web services is the same). In my organization I have 2 Active Directory domain (DOMAIN and DOMAINEXT). My Sharepoint farm is deployed in DOMAIN.

If I use the "classical" UI (and then People Picker control) it works and I can add external and internal user to my group but, if I use the API (like the method I've listed), it doesn't work (with the DOMAINEXT users).

Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(delegate()
            {

    using (SPSite scSite = new SPSite(fullsite))
            {
                    using (SPWeb scWeb = scSite.OpenWeb())
                    {
                        scWeb.AllowUnsafeUpdates = true;
                        scSite.AllowUnsafeUpdates = true;

                        SPGroup selectedGroup= scWeb.SiteGroups[groupName];
                        SPUser selectedUser= scWeb.EnsureUser(Username);
                        selectedGroup.AddUser(selectedUser);
                        selectedGroup.Update();

                        }

                    }
                }
            }

The exception that is thrown is this one:

You do not have permission to perform this action or access this resource. at Microsoft.SharePoint.SPGlobal.HandleComException(COMException comEx) at Microsoft.SharePoint.Library.SPRequest.UpdateMembers(String bstrUrl, UInt32 dwObjectType, String bstrObjId, Guid& pguidScopeId, Int32 lGroupID, Int32 lGroupOwnerId, Object& pvarArrayAdd, Object& pvarArrayAddIds, Object& pvarArrayLoginsRemove, Object& pvarArrayIdsRemove, Boolean bRemoveFromCurrentScopeOnly, Boolean bSendEmail) at Microsoft.SharePoint.SPUserCollection.UpdateMembers(Object objUpdateInfo, Object objAddIds, Object objRemoveLogins, Object objRemoveIds, Boolean fSendEmail) at Microsoft.SharePoint.SPUserCollection.AddCollection(SPUserInfo[] addUsersInfo, IEnumerable`1 addUsers) at Microsoft.SharePoint.SPUserCollection.Add(String loginName, String email, String name, String notes) at Microsoft.SharePoint.SPGroup.AddUser(SPUser user)

What the differences between the Peoople Picker behaviour and what I've written ?

Any help would be appreciated.

Thank you.

Answer 1

Since you say it works through the people picker, I assume your trusts are setup correctly but can you comment on how they are setup:

What Type? Forest, Domain, External What directions? Transitive, One-Way (which direction)

Can you also comment on the variable Username. What does the value inside this variable look like? Is it just samaccountname or is it domain\samaccountname? Or is it email address or UPN? Where are you getting it's value from?

Also, which domain is your SharePoint service account located in?

I've also used the adduser where you specify the email, name and notes in addition to the domain\samaccountname. I think you have to use this method when you are FIRST adding someone to the site but EnsureUser might take care of that for you.

You also might need to call a scWeb.Update() after the EnsureUser but I'm not positive.