Achim Gratz writes:
>> I don't understand what you're trying to say here. Are there
>> differences or not?
>
> You're on to something. I have over 500 groups in my token in the old
> domain, but only half of those end up in the token when I'm logged in on
> the machine in the new domain (at least as far as Cygwin is concerned as
> obviously I can still access the files when I'm actually trying). I
> scheduled an audience with one of the AD guys some time next week, he
> thinks he can explain why that happens and hopefully it's something that
> can be fixed on the AD side.
Here's what I understood of that: The problem was how the group that was
supposed to give me access was set up in AD a long time ago. Apparently
when you have an AD forest or a federation you can separately flag if
the groups are visible or valid outside the defining domain and it had
been set up to have restricted validity, while still being visible in
all domains. Only when both these flags are set will the group actually
be in your AuthZ token ("universal group"). Actual file access still
worked since the access was checked on the file server which was in the
"home" domain. So, the group got converted to a universal one and the
problem went away after that change had replicated to all DC.
Regards,
Achim.
--
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+
SD adaptation for Waldorf Blofeld V1.15B11:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
