{"id":126,"date":"2014-07-10T14:27:02","date_gmt":"2014-07-10T12:27:02","guid":{"rendered":"https:\/\/www.vioreliftode.com\/?p=126"},"modified":"2016-04-15T13:38:28","modified_gmt":"2016-04-15T11:38:28","slug":"active-directory-security-groups-and-sharepoint-claims-based-authentication","status":"publish","type":"post","link":"https:\/\/www.vioreliftode.com\/index.php\/active-directory-security-groups-and-sharepoint-claims-based-authentication\/","title":{"rendered":"Active Directory Security Groups and SharePoint Claims Based Authentication"},"content":{"rendered":"

It’s not happening only on SharePoint 2013. You will be in the same\u00a0situation if you are using\u00a0Claims Based Authentication\u00a0with\u00a0SharePoint 2010.<\/em><\/p>\n

 <\/p>\n

Out of the box behavior<\/span>
\nYou have a SharePoint Web Application configured to use Claims Based Authentication. You grant access to a SharePoint site through Active Directory Security Groups. You perform changes in the membership of that Active Directory Security Group and you notice the changes are not reflected immediately on the SharePoint site.
\nFor example you remove one user account from the AD security group membership, but the user is still able to access the site, or you add a new user to the membership of that security group, but the user still receives access denied on\u00a0SharePoint.<\/p>\n

 <\/p>\n

The explanation<\/span>
\nSharePoint Claims Based Authentication is working differently than SharePoint Classic Mode Authentication. When you have Claims Based Authentication, SharePoint is using the Security Token Service (STS) to provide\u00a0access tokens for server-to-server authentication.<\/p>\n

 <\/p>\n

The Wikipedia explanation for STS<\/a>:
\n“A Security Token Service (STS) is a software based identity provider responsible for issuing security tokens, especially software tokens, as part of a claims-based identity system.<\/em>
\nIn a typical usage scenario, a client requests access to a secure software application, often called a relying party. Instead of the application authenticating the client, the client is redirected to an STS. The STS authenticates the client and issues a security token. Finally, the client is redirected back to the relying party and present the security token. The token is the data record in which claims are packed, and is protected from manipulation with strong cryptography. The software application verifies that the token originated from an STS trusted by it, and then makes authorization decisions accordingly. The token is creating a chain of trust between the STS and the software application consuming the claims. This process is illustrated in the Security Assertion Markup Language (SAML) use case, demonstrating how single sign-on can be used to access web services.”<\/em><\/p>\n

 <\/p>\n

So, in our case:<\/p>\n