Active Directory groups as roles

Hi,

Using SiteFinity 9.1, I configured the LDAP connection in Settings/Advanced/Security/LDAP Settings/LDAP Connections.

I enabled the LDAP role provider and membership providers. I have installed and configured the STS project. I have setup the security token issuer in SiteFinity.

If I try to setup the roles that are allowed to view pages (from the Dashboard: pages / permissions for all pages, View pages / change / selected roles or users / add roles and users), under ldaproles, I can see all AD groups in the domain.

I created a simple widget that shows the claims of the current user. I created a page that has this widget. 

My problem is that this page shows only a small subset of the groups of any user. Namely, "Domain Users" is absent, while the AD administration interface shows that the user is indeed a domain user.

Why are some groups missing from the claims?

Regards,

Jean-Marie Pirelli