Hi,

A short question. I have an AD group called Intranet Admin that users can be added to if they must have this role in DNN. However, role synchronization does not work for the portal administrator role. Why is that?

The actual code that prevents synchronization from happening is found in DotNetNuke.Authentication.ActiveDirectory.UserController method AddUserRoles:

                'Put the AD Group rolenames into an arraylist.
                For Each authenticationGroup In colGroup
-->                 If Not (authenticationGroup.RoleID = objPortal.AdministratorRoleId) Then
                        arrDNNRoleNames.Add(authenticationGroup.RoleName)
                    End If
                Next
 

Kind regards,

Ronald Wildenberg
ITQ Celerior

You're slightly of base I'm afraid...

Role synchronization in the Active Directory authentication provider does not add or remove roles in DNN. Instead it adds/removes users to existing DNN roles based on group membership in Active Directory. This all works ok (except for bug 8903) except when the role is the portal administrator role.

I do not understand why this is explicitly disabled. If I add/remove a user to an AD group that represents the portal administrator role, why would this not be synchronized to DNN?

The fact that too many users are added to the Administrator role is caused by the default name of the role: Administrator. There's a fair chance that such a group exists somewhere in the AD. The first thing I did was change the role name to Intranet Admin. Once you've done that, there's no problem anymore.

So what you'd ideally want is the option to change role names (via the user interface, not in the database). Do you know why this is disabled? It would be a lot easier to synchronize AD groups and DNN roles when this would be possible.

I'll post a feature request for changing role names and another one for synchronizing the administrator role in the AD authentication provider.