Active Directory and Nested Groups

TeamSite 6.1 on W2k SP4

I'm having a bit of a problem with nested domain groups (active directory). I've read a few posts about similar issues and have read the "Interwoven Best Practices TeamSite and Active Directory" PDF. According to the PDF, what I want to do is possible.

Here's the scenario:
I have a branch shared by domain group pge\groupa. Group pge\groupa has 2 members: pge\usera, pge\groupb. groupb has 5 users in it and no groups. I create a workarea "load" and share it with pge\groupa. The owner of the workare has no problems with it, but the members of groupb can only access the workarea, but have no write privileges. In fact, the message I get when trying to edit a file is: Not a writable workarea: //SERVER/default/main/BRANCHNAME/WORKAREA/load

I've tried this same scenario a couple of times. Same results. Also, I've looked at the OS level permissions and they look right. Full access to pge\groupa.

Thanks in advance,

Jason

Find more posts tagged with

Comments

iwovGraduate

What kind of domain group are you using ? - groupa and groupb. Not all combinations of nesting are supported by TeamSite. This is mentioned in the AD Best Practice document. Also do you have the read group membership flag on ?

Migrateduser

> What kind of domain group are you using?
When I look at the domain group through an LDAP browser, it says the groupType = -2147483646. Since I'm not the domain system admin, I don't have direct access to the active directory other than through a 3rd party LDAP viewer.

> Also do you have the read group membership flag on?

Not sure. I'm checking with our domain admins. I've looked in the TeamSite/AD guide and it doesn't look like nested groups not working is a symptom of read group membership not being selected. Have you found that it is a symptom?

Thanks,

Jason

iwovGraduate

see:
https://support.interwoven.com/kb/kb_show_article2.asp?ArticleID=49028

iwovGraduate

Try loggin in as master with one of the users in groupb. Do you still get same error while trying to edit ?

Migrateduser

No. Masters can access everything fine.

I'll check out the support articles.

- Jason

iwovGraduate

I had the same symptoms last year with TS 6.0, W2K, AD native mode. Are you using AD in native mode or mixed mode ?

You can try the following not very well documented flags in iw.cfg to get more verbose logging. :


[iwserver]
# The following 3 lines is for more verbose logging iw-trace.log. Warning: verbose = very verbose. 
#show_user_list=true
#show_user_list_verbose=true
#debug_operations=true

IWOV also suggested we use netmonitor=no in iw.cfg. I never understood what it does.

Can you post your iw.cfg ?

Migrateduser

> Are you using AD in native mode or mixed mode ?

To be perfectly honest, I'm pretty far from being an A.D. expert. All I know is that the domain groups for the entire corporation are controlled by A.D. I'm not using any local groups on the teamsite server.

Don't think I should make any major modifications to the iw.cfg since I won't be here after today to undo them.

I don't think the problem is in the iw.cfg since I just found out that some of the groups are working correctly. We have another branch shared by a group with nested groups in it, and I am a member of one of the nested groups. I can access the branch (as an editor) and have read/write access to the workarea & files. I'm starting to lean toward the issue being the Read Group Membership thing that you and the support articles mentioned. I have a meeting with our domain admin this afternoon. Hopefully he and I will get it worked out. If we do, I'll post the solution. If we don't, I'll post my resume ;-)

Thanks for your help.

- Jason

iwovGraduate

Read Group Membership is most likey the problem you are having.

Another issue might be that the nesting you are using might not be one of the supported ones. AD has several types of groups: domain local groups, domain global groups, etc. Not all combinations of nesting is supported.

Disclaimer: I am no AD expert myself. But have gone through these issues a couple of times.

NathansDIS

Can anyone point me to the using TeamSite with Active Directory best practices document? I searched the KB and the forum as recommended and didn't find it. Thanks in advance for your time.

-nathan
Washington State DIS
~~~

iwovGraduate

KB #48863 : TeamSite and Active Directory

also available on DevNet -
http://devnet.interwoven.com/site.fcgi/techlib/site.fcgi/techlib/48863

...lissa edit added DevNet URL. no other changes made.

Edited by lissa on 02/24/05 08:58 AM (server time).