I have two domains A and B
Domain A contains a security-group SEC. This group is used to access a web application. The group is a security group, and the type of the group is domain local. This domain also contains most of the users.
Domain B contains a few users, and these users are direct members of the security group located in domain A
In my web application (ASP.NET MVC) i use the integrated windows auth provider, which checks if a user is a member of the security group. Afterwards i locate the user in active directory, and assigns the user a bunch of roles based on what active directory groups they are a member of.
When querying the tokengroups property on the users from domain A i can see they are member of the SEC group.
But when querying the members of domain B, also by using the tokengroups property, I do not see the SEC group in the tokengroups property.
My questions
Why do the members in domain B seems to not be a member of the group, when they really are? I use the tokengroups property when looking up groups on a user.
The reason i belive they are is because i can see the users in the list of members when looking at the properties of the group. Furthermore, they are authenticated in the web application, but when my module tries to find the groups of the members from domain B, the SEC group is just not there.
Is the current setup with all the groups being security groups, and domain local, really the best way? What I need is a bunch of "marker" groups that i can add groups and users to, from multiple domains.
To get the security groups of a user, i use the tokengroups property. Like this http://tutorials.csharp-online.net/User_Management_with_Active_Directory%E2%80%94Retrieving_the_Users_Token_Groups
