User has no access

[ITSyncForce]

I am trying to upgrade our environment from 2018 to 2019. As I also will be enforcing permissions I setup a new DB and I as admin can login. I created a testuser to check that all permissions are set correct for that group of users and all seemed Ok. 

Next I tried to add another user by installing 2019 on his computer (new user no previous versions installed) but the user gets an error

User with name 'Jan ....' and SID 'S-1-....' has no access to login.

So odd enough more users have this problem but not all. 

This is preventing us from upgrading. Anybody an idea why this is happening?

I found this thread and the solution indeed fixes the login problem however I need the permissions enabled. 
https://remotedesktop.rocketsoftware.com...?tid=10113

[DevOma]

Did you create some security groups in ASGRD and have assigned the users to these groups? Because the error says that the users are not assigned to any of the security groups in your database. If AD-Groups are not working you should try to assign the users directly (AD-Account).

Perhaps you only checked the permissions on SQL-Server?

[ITSyncForce]

Did you create some security groups in ASGRD and have assigned the users to these groups? Because the error says that the users are not assigned to any of the security groups in your database. If AD-Groups are not working you should try to assign the users directly (AD-Account).

Perhaps you only checked the permissions on SQL-Server?

I did create usergroups in ASG. I added the specific AD groups that should have access to the ASG usergroups. Odd enough some users that belong to AD group x and have been assigned to ASG group X have access, others do not. 

SQL access is fine. They connect using a SQL user that has access to this database

[DevOma]

Ok - did you try to add the non working accounts for testing by adding them directly? Is that working? Do the users have all read permissions for your ActiveDirectory?

The above error message tells me that the SQL access is working - but the UserIdentity could not be mapped inside ASGRD - so we need step by step analyzing what could be the issue…

Are the users all working on a computer that is joined to the ActiveDirectory?

[ITSyncForce]

I did add all the users manually and yes now it seems to be working. But why can I not use the groups? As said before. One user in a group has access the other not...

[DevOma]

In the login process the assigned groups are read and all users that are in the group should have access - so the user needs read access to the AD to ensure that the assignment to the group can be validated.

So once again - are the users who can't login are working on a computer that is also joined to the AD? Else the permissions could be different and the user group can't be read successfully by the program?!?

[ITSyncForce]

In the login process the assigned groups are read and all users that are in the group should have access - so the user needs read access to the AD to ensure that the assignment to the group can be validated.

So once again - are the users who can't login are working on a computer that is also joined to the AD? Else the permissions could be different and the user group can't be read successfully by the program?!?

Users are all working on domain joined computers. 

I fixed it for now by adding all AD users manually to the ASG group instead of the AD group. Luckily we do not change that much users so I should be fine now.