0

I'm attempting to sort out security permissions in our 8.1u3 installation, but I've run into a curious snag: we use the Active Directory connector to pull in all of the users and security groups from AD, but most of them don't show up in Security Editor, Access Viewer, etc. Everyone's able to log in as expected and all of their groups show up when I go to the "member of" tab in User Manager, but I'm unable to view or change security settings for most of them. A few random roles do show up so clearly the connector isn't completely broken, but it's only a small handful out of hundreds of groups.

I've checked that we're using the correct version of the connector for our version of Sitecore (1.2 r 141225).

I've checked on the web.config files and it seems to be correct:

  <providers>
    <clear />
    <add name="ad" type="LightLDAP.SitecoreADMembershipProvider" connectionStringName="connstring" applicationName="sitecore" minRequiredPasswordLength="1" minRequiredNonalphanumericCharacters="0" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" connectionProtection="Secure" attributeMapUsername="sAMAccountName" enableSearchMethods="true" storeFullNames="false" wildcard="*" domains="ad" />
    <add name="switcher" type="Sitecore.Security.SwitchingMembershipProvider, Sitecore.Kernel" applicationName="sitecore" mappings="switchingProviders/membership" />
    <add name="sitecore" type="Sitecore.Security.SitecoreMembershipProvider, Sitecore.Kernel" realProviderName="switcher" providerWildcard="%" raiseEvents="true" />
    <add name="sql" type="System.Web.Security.SqlMembershipProvider" connectionStringName="core" applicationName="sitecore" minRequiredPasswordLength="1" minRequiredNonalphanumericCharacters="0" requiresQuestionAndAnswer="false" requiresUniqueEmail="false" maxInvalidPasswordAttempts="3" />
  </providers>
</membership>
<roleManager defaultProvider="sitecore" enabled="true">
  <providers>
    <clear />
    <add name="ad" type="LightLDAP.SitecoreADRoleProvider" connectionStringName="connstring" applicationName="sitecore" attributeMapUsername="sAMAccountName" cacheSize="20MB" />
    <add name="switcher" type="Sitecore.Security.SwitchingRoleProvider, Sitecore.Kernel" applicationName="sitecore" mappings="switchingProviders/roleManager" storeFullNames="false" wildcard="*" domains="ad" />
    <add name="sitecore" type="Sitecore.Security.SitecoreRoleProvider, Sitecore.Kernel" realProviderName="switcher" raiseEvents="true" />
    <add name="sql" type="System.Web.Security.SqlRoleProvider" connectionStringName="core" applicationName="sitecore" />
  </providers>
</roleManager>
<profile defaultProvider="sql" enabled="true" inherits="Sitecore.Security.UserProfile, Sitecore.Kernel">
  <providers>
    <clear />
    <add name="sql" type="System.Web.Profile.SqlProfileProvider" connectionStringName="core" applicationName="sitecore" />
    <add name="switcher" type="Sitecore.Security.SwitchingProfileProvider, Sitecore.Kernel" applicationName="sitecore" mappings="switchingProviders/profile" />
  </providers>
</profile>

(Some irrelevant parts clipped.) I note that there's no profile provider for the AD connector, from what I understand of the documentation that's not required. Would that interfere with Security Editor being able to see AD groups?

Anyone have any other thoughts on why they're not showing up? Or advice on troubleshooting this (unfortunately I don't have access to our Active Directory)?

  • What does your Group filter look like? I assume you don't want all groups from active directory to appear. I'm curious how many groups can load before the cache limit is hit. – Michael West May 26 at 21:39
  • We are not currently using a filter, as far as I can tell. It'd show up in the provider declarations above, correct? Any way we can check on whether the cache limit is being hit? – Michael Smith May 27 at 12:55
  • Hmm. Looking at the cache.aspx page for the server, the roles cache is nowhere near full (<2KB on a 20MB cache) and the user cache is similar, but the members and memberOf caches aren't populated at all (despite having defined sizes). That seems odd. – Michael Smith May 27 at 13:11
  • I think in most cases the AD roles are assigned dynamically and not persisted in the database, right? – Richard Hauer May 28 at 15:01
  • This looks to have been cache related after all. Despite the caches not actually having anything in them, manually clearing them resolves the issue. – Michael Smith Jun 2 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.