Return
-
Title
Cross Forest object information cannot be viewed -
Description
Cross-forest object information cannot be read via Active Roles. If you are not a member of the ARS admin group. This also includes, for example, the times (edsva-ScheduledLink-EndTime, edsva-ScheduledLink-StartTime) of a temporary group membership. What are the correct permissions to control who can and cannot see this information?. -
Cause
Delegation issue. Active Roles has a Zero-Permissions model, a user cannot see anything unless it has been granted correct permissions. -
Resolution
If the delegate does not have correct permissions applied in Active Roles on the other AD Forest/Domain, the following will occur:
- The delegate will not see temporary details for the foreign member:
- The delagate will not see foreign member properties.
- The delegate will see the foreign member listed in the group once the member has been already added to the group:
In order for a delegate to be able to see temporary details as well as foreign user properties, the delegate needs read permissions applied on the other AD Forest/Domain via Active Roles.