It's possible to use Sharepoint2013 by permitting a user directly on the site. I can either put it into a SharePoint group or give it the appropriate permissions directly. But if I add a AD security group to the site security settings and give that group FullPermission, no member of that AD group is able to log in properly. The SSO is set into place, the user gets authenticated - but not authorized. I know about the difference security group <> distribution group (which will not work in SharePoint). Any Ideas?

As addendum: SharePoint server and client are located in the same ActiveDirectory domain.


Have you waited 24 hours since the user last logged on or was added to the AD-group? The "problem" here is possible the life-time of the users Claims token, which by default is set to 24 hours.

This means that once a user has gotten a claim, SharePoint will not request a new one until the current on expires. And, if you add a new user to an AD-group, and then add this group as a member of something in SP, this new AD-group membership will not be added to the users claim!

If you wish to permanently, or temporarly, change the token lifetime you can use this PowerShell from below link

$sts = Get-SPSecurityTokenServiceConfig
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 2) #Here you should add what you think is a good lifetime
$sts.WindowsTokenLifetime = (New-TimeSpan -minutes 2) #Here you should add what you think is a good lifetime
$sts.LogonTokenCacheExpirationWindow = (New-TimeSpan -minutes 1) #Here you should add what you think is a good lifetime

Here is more details: http://blog.randomdust.com/index.php/2013/06/sharepoint-2013-claim-expiration-and-ad-sync/

| improve this answer | |

This morning, it somehow just started to work. Yesterday evening I even rebooted the server - no result. So I tried once again this morning, re-added the security group to sharepoint, permitting for contribution and it worked. Maybe we have some kind of caching-issue here?

| improve this answer | |
  • Solution might be in the post above! – stromflut Mar 5 '14 at 9:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.