Problem with nested Groups about entracp

[Yvand]

Hello, what version of AzureCP did you try?

[joker-it]

i use AzureCP v11 #12

[cblomart]

Are you sure nested groups should work?

When you set rights to a group in sharepoint i think it only reference the group by name.

In the claims augmentation i see that the groups augmentent are only the groups the user is direct member of. (AzureCP.cs:952)

[Yvand]

I fixed nested groups in v12, which brigs many changes and is still a beta for now.
Nested groups will work only if group claims are created with the ID of groups (and not their DisplayName).
More information on https://github.com/Yvand/AzureCP/releases/tag/v12

[joker-it]

i installed now beta version 12 of azurecp...
config Global: Display the UserPrincipalName (or DisplayName)
config ClaimType: http://schemas.microsoft.com/ws/2008/06/identity/claims/role | Group | Id | DisplayName

now when is set new permission: i got the groups with id... but permission works only with old "groups" with Claimtype = Name...

TrustedIdentityTokenIssuer Config:
DisplayName : Role
InputClaimType : http://schemas.microsoft.com/ws/2008/06/identity/claims/role
MappedClaimType : http://schemas.microsoft.com/ws/2008/06/identity/claims/role
IsIdentityClaim : False
AcceptOnlyKnownClaimValues : False
ClaimValueModificationAction : None
ClaimValueModificationArgument :
KnownClaimValues : {}
UpgradedPersistedProperties :

Any Idea what im doing wrong?

[Yvand]

Apart from still being a beta, v12 has breaking changes compared to previous versions, especially for group permissions.
To test permissions reliably, you need to create a new site collection, so that entities already added (regardless if there where deleted or not) do not interfere with the ones you are trying now.
With v12, assuming you use default claim types configuration:

• group permissions are created with group IDs
• nested groups are working

Of course, for group permissions to work, augmentation must be enabled in AzureCP settings