What is the correct way to add an AD group to an SP group with permissions?

Question

So in Sharepoint there are 2 ways to see the groups, site settings, people and groups (I see my AD groups there twice), or site setttings permissions, I see the group there only once.

All I need is to add an AD Group into an existing SP group with the contribute permission level.

The code below works fine but the questions are the following1

Why the ad group appears 2 times in People and Groups? how can I fix that? why adding the ad group to an sp group is not enough? you still have to add a permission level to the ad group. If I dont do the ensureuser, then the roleaassignments.add fails with user not found

  string xlosgroupnamewithdomain = string.Concat(domainName, @"\", xlosgroupname);
                            SPUser adLosGroup = web.EnsureUser(xlosgroupnamewithdomain);
                            membersGroup.AddUser(adLosGroup);
                            SPRoleDefinition contribute = web.RoleDefinitions.GetByType(SPRoleType.Contributor);
                            SPRoleAssignmentCollection roleAssignments = web.RoleAssignments;
                            SPRoleAssignment roleAssignment = new SPRoleAssignment(xlosgroupnamewithdomain, string.Empty, string.Empty, string.Empty);
                            SPRoleDefinitionBindingCollection roleDefBindings = roleAssignment.RoleDefinitionBindings;
                            roleDefBindings.Add(contribute);
                            roleAssignments.Add(roleAssignment);

EDIT:
When I try to do this, it says the user does not exist. in the adduser line

 string xlosgroupnamewithdomain = string.Concat(domainName, @"\", xlosgroupname);
                            web.EnsureUser(xlosgroupnamewithdomain);
                            var adLosGroup = web.Users[xlosgroupnamewithdomain];
                            membersGroup.AddUser(adLosGroup);

Answer 1

I am pretty sure you are seeing two because you likely named the Sharepoint Group and the AD group the same thing. If you had different names you would notice they are different and you are seeing a user (the AD group) and the group (the SP group).

EnsureUser is a method that checks to see if the user exists and if not then it creates it, this is necessary because you cannot add a user that doesn't exist in sharepoint to a group.

I don't believe you have to add a permission level if you are adding groups at the site collection level.

Here is what I did using powershell so you could probably use a similar concept:

$w = Get-SPWeb $SiteCollectionURL
$w.EnsureUser("DOMAIN\User")
$ADGroup = $w | Get-SPUser "DOMAIN\User"
$SPGroup = $w.SiteGroups["Sharepoint Group"]
$SPGroup.AddUser($ADGroup)
$SPGroup.Update()

Answer 2

The problem was this line:

SPRoleAssignment roleAssignment = new SPRoleAssignment(xlosgroupnamewithdomain, string.Empty, string.Empty, string.Empty);

I should use in the SPRoleAssignment constructor the SPGroup used before. and not the groupname string. Then it works fine