"Sorry, this site hasn't been shared with you." if using AD Security Groups directly

Question

It's possible to use Sharepoint2013 by permitting a user directly on the site. I can either put it into a SharePoint group or give it the appropriate permissions directly. But if I add a AD security group to the site security settings and give that group FullPermission, no member of that AD group is able to log in properly. The SSO is set into place, the user gets authenticated - but not authorized. I know about the difference security group <> distribution group (which will not work in SharePoint). Any Ideas?

As addendum: SharePoint server and client are located in the same ActiveDirectory domain.

Answer 1

Have you waited 24 hours since the user last logged on or was added to the AD-group? The "problem" here is possible the life-time of the users Claims token, which by default is set to 24 hours.

This means that once a user has gotten a claim, SharePoint will not request a new one until the current on expires. And, if you add a new user to an AD-group, and then add this group as a member of something in SP, this new AD-group membership will not be added to the users claim!

If you wish to permanently, or temporarly, change the token lifetime you can use this PowerShell from below link

$sts = Get-SPSecurityTokenServiceConfig
$sts.FormsTokenLifetime = (New-TimeSpan -minutes 2) #Here you should add what you think is a good lifetime
$sts.WindowsTokenLifetime = (New-TimeSpan -minutes 2) #Here you should add what you think is a good lifetime
$sts.LogonTokenCacheExpirationWindow = (New-TimeSpan -minutes 1) #Here you should add what you think is a good lifetime
$sts.Update()
iisreset

Here is more details: http://blog.randomdust.com/index.php/2013/06/sharepoint-2013-claim-expiration-and-ad-sync/

Answer 2

This morning, it somehow just started to work. Yesterday evening I even rebooted the server - no result. So I tried once again this morning, re-added the security group to sharepoint, permitting for contribution and it worked. Maybe we have some kind of caching-issue here?