I'm adding users programmatically to a SharePoint site. I'm doing this by adding the users domain login into the "[SiteName] Members" group. Unfortunately, users added this way are not able to authenticate to the site.

If I manually "Share" the site with a user (by typing their same domain login into the SharePoint control), the user is added to "[SiteName] Members" and can authenticate via Active Directory with no issue. In addition, users added via "Share" have "i:0#.w|" prefixed to their domain logins by SharePoint, while users added programmatically do not.

Does anyone know why users added programmatically via their domain logins are not able to authenticate?

Thanks for any help.


using(var web = site.OpenWeb(webUrl))
    foreach(var userDef in usersToAdd)
        //Use EnsureUser rather than AllUsers.Add()
        var user = web.EnsureUser(userDef.UserName);
        user.Email = userDef.Email;
        user.Name = userDef.Name;
        user.Notes = userDef.Notes;


1 Answer 1


The prefix is a claims identity prefix:

i:0#w| =>
  i = identity
  # = user login name
  w = Windows

so this is a Windows Authentication Claims Identity, which is correct as long as you have configured Claims Authentication on the site.

Call SPWeb.EnsureUser() after you create the user object to add the user to the hidden User Information List for the site collection. Otherwise, the user identity will exist in the security group, but not in the User Information List, therefore causing the new identity to be unable to authenticate.

  • Please disregard my previous comment (now deleted, I hadn't closed and reopened my test browser). This works, thanks.
    – MgSam
    Commented Jan 24, 2013 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.