LdapRoleProvider and Audience Targeting Bug

The MOSS 2007 LdapRoleProvider could be your greatest friend or your worst enemy. Getting it configured correctly is a pain. See the community content I added here for some of my tricks.

There are some limitations on SharePoint role providers:

• Cannot use the people picker search feature to find partially typed group names
• You can only have one provider per SharePoint application zone
• You cannot share a provider across applications/zones
• The role provider groups cannot be directly accessed via Audience targeting

Today, I spent the day figuring out the following bug and resolution.

Scenario

• You have configured audience targeting to use SharePoint groups because you cannot directly target Ldap groups
• The SharePoint groups contain the Ldap groups
• The SharePoint groups have no inherent permissions defined

Issue

• The targeted web part does not display even though the user is in the appropriate ldap group

Resolution

• The SharePoint group must have at least one permission applied to it.
• I recommend using the Read or Restricted Read permission, since this should be a minimal permission. Alternatively, create your own minimal permission level.

My guess is that the SP group only parses the RoleProviders upon a permission request. This means that if there have been no relavent permission requests against the group, the group will only contain the non-roleprovider entries (individual accounts) and will not return the correct results to the audience targeting request.