check permissions showing incorrect information

Question

I have a weird problem. A colleague created an AD security group and added some existing security groups as members. I created a sharepoint group and added the security group. All seemed fine. I assigned the sharepoint group to a library and gave it contribute rights. All good so far. I checked a few employees using check permissions that i know are in the sub groups and am getting some weird results. Basically some users dont show as having the correct permissions whilst others do. Even stranger, employees that show the incorrect permissions can still edit the documents. So it seems the permissions are actually correct. Its just check permissions isnt.

Any ideas?

Answer 1

This could be the case of Authorization Failures with Claims-Based Authentication in SharePoint 2010 if you are using claim base authentication.

This happens It because the claims token has a default lifetime of 10 hrs. This means that the token is only built once every 10 hrs and then cached. This cached token is used for all subsequent requests.

Try doing IISREST. This will clear the Security Token Service (STS) session value.

Next You can change the value of the session timeout using a PowerShell script. There are separate lifetime values for both Windows and FBA tokens. The following script sets both values to 60 minutes.

$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime = (New-TimeSpan –minutes 60)
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 60)
$sts.Update()
iisreset

for more detailed information go here: http://www.shillier.com/archive/2010/10/25/authorization-failures-with-claims-based-authentication-in-sharepoint-2010.aspx

Answer 2

According to this link, this is expected behaviour if a user has never previously accessed SharePoint...

Check Permissions queries the UserInfo list to retrieve permissions and if a user has never accessed SharePoint, then they won't exist in the list and the Check Permissions would return "none". This is true for all versions of SharePoint 2010 and 2013.