Re: Kerberos, MOSS 2007 AD Group Membership
- From: "Anthony" <anthony.spam@xxxxxxxxxxxxxx>
- Date: Sun, 26 Aug 2007 14:02:52 +0100
Dave,
The list of group memberships is read at logon from the KDC. This remains
valid until it expires, or is renewed by logoff/logon. Its the same for file
access. You can grant permissions to an existing group and it will take
effect immediately, but you can't add a member to a group and have that take
effect immediately.
Anthony,
http://www.airdesk.co.uk
"dwthoma" <dwthoma@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:D33E52BA-5402-4CA1-917A-29488CD20FB0@xxxxxxxxxxxxxxxx
I have a MOSS 2007 Server that is a member of our Active Directory. We
enabled kerberos in Sharepoint which works very well.
We have one site that is setup with a Sharepoint group -> nested inside
that
is an Active directory security group (called CORE) where active directory
users are updated frequently. When a user who is a member of this Active
directory security group (CORE) group accesses this website he sees extra
details on the site. When a user is not a member of this (CORE) group he
sees
only the standard information on the website.
What seems to be the trouble is that....if i have made a user a member of
this (CORE) AD Group it can take up to 10 hours to reflect that
information
on the page. The user will not see the extra information on the screen for
up
to 10hours.
I found that all active directory controllers update the group membership
pretty much immediately after a change. Also I have found that if i purge
the
users kerberos tickets on his desktop using KERBTRAY the information
updates
on the webpage immediately.
It seems that Kerberos ticket is not updating on the users computer if
they
a made a new member of the CORE ad group (until the kerberso ticket
expires
after 10hours).
Why would this occur with kerberos in sharepoint/IIS when fileshares
....ie
a network share immediately allows access in the same scenario......which
is
also kerberos authentiaction?
Is there a problem with kerberos/IIS? is the deployment different?
The problem doesnt exist if i switch the site to NTLM. But corporate
policy
stipulates kerberos should be used.
Any help or insight into this would be awesome!
--
davebrave
.
- Prev by Date: Re: Questions on WID
- Next by Date: Re: Issues with authentication on a website
- Previous by thread: stsadm "web site already in use" error
- Next by thread: Known Notebooks Running Windows Server 2003
- Index(es):
Relevant Pages
|
