8

Let's say I have an AD group called domain\Group1, in SharePoint I create a group called Group 1. In the SharePoint group I add the corresponding domain group. Now if I add a user to the domain group, shouldn't that user have access to wherever the SharePoint group have access or does the UPS have to be set up for this? I don't won't to write back to AD or anything, just grant users access.

Thanks in advance.

Improve this question
2
  • Is your active directory group security enabled? It should be since you were able to add it to the SharePoint group...
    – Kit Menke
    Commented Sep 3, 2013 at 17:13
  • There also could be an issue with UPS configuration when you selected not all AD DS containers or make some custom selections in your connection properties.
    – Mike
    Commented Jun 29, 2015 at 12:51

2 Answers 2

Reset to default
8

Late answer but, The User Profile is not responsible in this case.

SharePoint recognizes AD security groups and attaching permissions to these groups will cause the permissions to be granted to the User.

Unfortunately, due to SharePoint caching the user's memberships on login, changes made to a security group are identified only after the cache has expired, possibly taking as long as 10 hours (by default) for it to happen.

This causes the unexpected behavior of adding a user to a Group and the user still being shown the access denied or lack of interface feedback related to the new permissions he should have received.

The user not having his tokens cached prior to being added to the group would cause him to receive access immediately.

Serge Luca's Blog

Viorel Lftode's Blog

Improve this answer
2

Instead of changing the STS configuration as suggested in the blog posts, I'd suggest to just clear the Logon Token Cache.

Clear-SPDistributedCacheItem –ContainerType DistributedLogonTokenCache
Improve this answer
3
  • 1
    Old post, but justed wanted to drop my 5 cents. I completely agree with Michael Schau. While you can set the token expiration manually, this can have unwanted side effects. I did it in a bi portal I've been working on and suddenly users were no longer authenticated on the SSAS cube. Needless to say, this is unwanted in a bi solution :)
    – user306393
    Commented Feb 13, 2015 at 10:22
  • 1
    If you reset IIS, you should expect logins to be reset, because you just reset the system people are logged into.
    – DubStep
    Commented May 26, 2015 at 16:11
  • I tried but seems like it did not work for me. I am simply trying to check the permissions of users who was added in the AD group ( AD group in is SP Group), SharePoint says it has no permissions through that SP Group.
    – Umr
    Commented Oct 19, 2017 at 20:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.