I have deployed a .NET application to a machine running Windows Server 2008 R2. The application uses Windows Authentication, and will only allow access to members of any of 3 particular roles.
The application is currently not letting anyone in, even users who are members of these roles. I logged into the machine myself and, using PowerShell, typed in the command
whoami /Groups
This lists my role membership, and interestingly, doesn't include any of the roles that my application requires. Presumably this is why noone is able to use the application: the computer itself cannot detect that users are members of the required roles.
I don't have control over the network but the admins assure me that the relevant users are assigned to the correct roles in Active Directory. All users and roles mentioned are domain users and roles.
Is there some fine-grained subtlety of domains in AD I'm unaware of? For example, are there subdivisions of a domain for which some roles are not visible? I'm pretty stuck here.