Augmentation and workflow permissions about ldapcp

[Yvand]

@Jo311 your observations are basically correct, let me add some precisions:

• option "query this server" determines if this connection is used to get group membership. If it is not set, then this connection is skipped
• when “Use .Net helper” is set: LDAPCP gets group membership using UserPrincipal.GetAuthorizationGroups(), which does not accept any LDAP filter, so applying the LDAP filter set on the group claim type would be impossible/challenging.
• when “Use .Net helper” is NOT set: LDAPCP gets group membership by reading the value of the LDAP property that stores the group names in user object. Here it would also be impossible/challenging to use a LDAP filter.

So I don't see an easy solution for your scenario. Is it that bad to return all the groups?

[Jo311]

@Yvand
Thanks for the info.
The way I understand this is that it makes no sense in selecting “Use .Net helper” or not, as long as "query this server" is not selected?

So, as a solution to our initial problem that WFs cannot be started if permissions are given with AD groups, "query this server" must be selected. Selecting “Use .Net helper” or not does not have an influence on this.

I did some extra tests, it looks like if “Use .Net helper” is NOT selected (but "query this server" is), besides the groups sent by ADFS starting with sp_, LDAPCP will also find AD groups not starting with sp_ where the user is directly member of.
If “Use .Net helper” is also selected, LDAPCP will find a whole bunch of additional parent (nested) groups. Not selecting “Use .Net helper” seems like the better approach.

In our case these additional groups in both scenarios are a possible issue because we are migrating sites from SP16 (where PP is showing all groups) to SP19 (where PP is only showing sp_ groups).
If permissions were given on a site to a group not starting with sp_ in SP16, that user will still be able to get access to the migrated SP19 site – which is not what we want.
If "query this server" would not be activated, that specific group claim would not be present and therefore the user would not be able to access the site.

On the other hand, thinking on it now, there are probably ways around this for us to handle as part of the migration scenario. E.g. get a list of these “non-sp_” groups and get rid of them in a proper way.

[Yvand]

@Jo311 correct, option "Use .Net helper" is totally ignored if "query this server" is not selected.
I think you got the big picture on the way it works, and getting rid of the non "sp-" groups looks like a good solution if it is applicable

[Jo311]

@Yvand
Ok thx you can close this ticket for me