6

Let's say I have an AD group called domain\Group1, in SharePoint I create a group called Group 1. In the SharePoint group I add the corresponding domain group. Now if I add a user to the domain group, shouldn't that user have access to wherever the SharePoint group have access or does the UPS have to be set up for this? I don't won't to write back to AD or anything, just grant users access.

Thanks in advance.

  • Is your active directory group security enabled? It should be since you were able to add it to the SharePoint group... – Kit Menke Sep 3 '13 at 17:13
  • There also could be an issue with UPS configuration when you selected not all AD DS containers or make some custom selections in your connection properties. – Mikhail Jun 29 '15 at 12:51
5

Late answer but, The User Profile is not responsible in this case.

SharePoint recognizes AD security groups and attaching permissions to these groups will cause the permissions to be granted to the User.

Unfortunately, due to SharePoint caching the user's memberships on login, changes made to a security group are identified only after the cache has expired, possibly taking as long as 10 hours (by default) for it to happen.

This causes the unexpected behavior of adding a user to a Group and the user still being shown the access denied or lack of interface feedback related to the new permissions he should have received.

The user not having his tokens cached prior to being added to the group would cause him to receive access immediately.

Serge Luca's Blog

Viorel Lftode's Blog

1

Instead of changing the STS configuration as suggested in the blog posts, I'd suggest to just clear the Logon Token Cache.

Clear-SPDistributedCacheItem –ContainerType DistributedLogonTokenCache 
  • Old post, but justed wanted to drop my 5 cents. I completely agree with Michael Schau. While you can set the token expiration manually, this can have unwanted side effects. I did it in a bi portal I've been working on and suddenly users were no longer authenticated on the SSAS cube. Needless to say, this is unwanted in a bi solution :) – user306393 Feb 13 '15 at 10:22
  • 1
    If you reset IIS, you should expect logins to be reset, because you just reset the system people are logged into. – DubStep May 26 '15 at 16:11
  • I tried but seems like it did not work for me. I am simply trying to check the permissions of users who was added in the AD group ( AD group in is SP Group), SharePoint says it has no permissions through that SP Group. – Umr Oct 19 '17 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.