It is not possible to assign roles for the Active Directory groups, when particular roles are assigned for AD groups. It is being assigned but access is not granted/provided.
Issue Description
When logging in through AD, while fetching group membership, the following error is thrown:
UiPath.IdentityServer.Directory.Abstractions.Interfaces.IDirectoryAdapterConfiguration Error retrieving AD security groups for .
InvalidOperationException*This Principal object represents a well-known SID and does not correspond to an actual store object. This operation is not supported on it.* at System.DirectoryServices.AccountManagement.Principal.CheckFakePrincipal()
at System.DirectoryServices.AccountManagement.Principal.GetUnderlyingObject()
at UiPath.IdentityServer.Directory.Active.ActiveDirectoryExtensions.ToDirectoryGroupDto(GroupPrincipal principal, String domain)
at UiPath.IdentityServer.Directory.Active.ActiveDirectoryClient.<>c__DisplayClass23_0.b__0(GroupPrincipal x)
at System.Linq.Enumerable.SelectEnumerableIterator`2.MoveNext()
at System.Linq.Enumerable.WhereEnumerableIterator`1.ToArray
at System.Collections.Immutable.ImmutableExtensions.FallbackWrapper`1.get_Count()
at System.Collections.Immutable.ImmutableList`1.CreateRange(IEnumerable`1 items)
at System.Collections.Immutable.ImmutableList`1.AddRange(IEnumerable`1 items)
at System.Collections.Immutable.ImmutableList.ToImmutableList[TSource](IEnumerable`1 source)
at UiPath.IdentityServer.Directory.Active.ActiveDirectoryClient.GetGroupsByUserPrincipalInternal(String domain, UserPrincipal principal)
at UiPath.IdentityServer.Directory.Active.ActiveDirectoryClient.GetGroupsByUserPrincipal(String domain, Func`1 principalFunc, CancellationToken token)
at UiPath.IdentityServer.Directory.Active.ActiveDirectoryClient.GetUserGroupsAsync(DirectoryIdentifier directoryIdentifier, IEnumerable`1 groupIdentifiers, CancellationToken token)
Root Cause
The GetGroupsByUserPrincipal returns a Well Known SID due to the AD configuration for the user and fails to complete the group fetch.
Resolution
Switch to TokenGroups. This fetch strategy uses a different implementation for retrieving groups, which means it won't encounter the same issue, and it will be quicker.
As a workaround, consider switching to tokengroups, which is both faster and does not populate the groups using the code that throws the error. For more details, see Performance - Best Practices.