Karl Wright created CONNECTORS-891:
--------------------------------------
Summary: SharePoint 2010 claim space authorization fails for AD
groups
Key: CONNECTORS-891
URL: https://issues.apache.org/jira/browse/CONNECTORS-891
Project: ManifoldCF
Issue Type: Bug
Components: SharePoint connector
Affects Versions: ManifoldCF 1.5
Reporter: Karl Wright
Assignee: Karl Wright
Fix For: ManifoldCF 1.5.1, ManifoldCF 1.6
It looks like, at least in some cases, in SharePoint 2010 it is not SharePoint
groups that correspond to AD groups, but rather SharePoint *users* that
correspond to AD groups. For example:
{code}
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xmlns:xsd="http://www.w3.org/2001/XMLSchema";>
<soap:Body>
<GetUserCollectionFromGroupResponse
xmlns="http://schemas.microsoft.com/sharepoint/soap/directory/";>
<GetUserCollectionFromGroupResult>
<GetUserCollectionFromGroup>
<Users>
<User ID="3620" Sid="" Name="Axxx Dxxx"
LoginName="i:0#.w|domain\dxxx" Email="..." Notes="" IsSiteAdmin="False"
IsDomainGroup="False" Flags="0"/>
<User ID="1199" Sid="" Name="itstrain"
LoginName="i:0#.w|domain\itstrain" Email="..." Notes="" IsSiteAdmin="False"
IsDomainGroup="False" Flags="0"/>
<User ID="2871" Sid="" Name="Law Library helpdesk account"
LoginName="i:0#.w|domain\reflaw" Email="..." Notes="" IsSiteAdmin="False"
IsDomainGroup="False" Flags="0"/>
<User ID="5135" Sid="" Name="Library Desk - GP"
LoginName="i:0#.w|domain\lib-deskgp" Email="" Notes="" IsSiteAdmin="False"
IsDomainGroup="False" Flags="0"/>
<User ID="5899" Sid="" Name="DOMAIN\$0kjf00-gcsje70g79fm"
LoginName="c:0+.w|s-1-5-21-3052554794-3770484871-3874881240-511616" Email=""
Notes="" IsSiteAdmin="False" IsDomainGroup="True" Flags="0"/>
</Users>
</GetUserCollectionFromGroup>
</GetUserCollectionFromGroupResult>
</GetUserCollectionFromGroupResponse>
</soap:Body>
</soap:Envelope>
{code}
We therefore need to look at child users of groups to come up with the right
tokens. Furthermore, the SharePoint/AD authority should always generate user
tokens, not group tokens.
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)
