1

I have SharePoint 2010, on which each WebApplication have two zones - one Windows authentication and another is FBA via LDAP. The zone with FBA is allowed for anonymous access. Users are able to login with no problem in both zones.

Now, lets say I want on some web to take down anonymous access and give only to specifiec FBA users/roles access to it, by adding those FBA users/roles to SharePoint's group "Site Visitors". If I add user, then there is no problem - only this user is able to browse the web, however if I add role, none of he user from this role are able to access the web. Thye all got "Access Denied".

It seems like SharePoint fails to get roles for the FBA user and check whether this role has permissions to the web.

Improve this question

3 Answers 3

Reset to default
1

Yes, role manager was configured. I managed to resolve it. The problem was in configuration of role manager in web.config of Security Token Service Application, "userNameAttribute" was not correct.

Improve this answer
0

Did you also enable the role manager? http://technet.microsoft.com/en-us/library/ee806890.aspx

Improve this answer
0

The problem is that the Role Provider doesn't know where the Users exist if you're Groups and Users reside in different OU's within AD.

Adding the userContainer= line that you have within your MemberProvider input to the RoleProvider in the web.configs will fix the issue.

http://social.technet.microsoft.com/Forums/en-US/9592df6b-d789-49c0-b1ec-142828cdadc8/fba-ldap-domain-group-members-getting-access-denied?forum=sharepointadminlegacy

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.