Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I've a site which uses some custom roledefinitions for assigning rights to users. I have implemented a method which checks if a certain user is assigned to a specific role, this method is as follows:

public bool IsUserInRole(SPUser user, SPWeb web, string roleName)
{
  SPRoleAssignment roleAssignment = web.RoleAssignments.GetAssignmentByPrincipal(user);
  SPRoleDefinition roleDefinition = web.RoleDefinitions[roleName];

  return roleAssignment.RoleDefinitionBindings.Contains(roleDefinition);
}

Now this works, but it doesn't take groups into account. For instance, if I place the user in a group which has contribute rights on a site, this function still returns false when I check for contribute rights.

I couldn't find the API call to perform the check the way SharePoint does it. Who knows if this call exists and if not: what would be a good way to mimic it? I could ofcourse get all the groups the user is enrolled in, get the assigned roles for those groups and check if the specified role exists in those collections; but that sounds a bit ugly and less performant.

To add some more info: SPUser.Groups only get's the SharePoint defined groups, so when you want to use this in combination with AD groups, even iterating the Groups property won't do.

share|improve this question
    
Wow, I've been looking for a code snippet like this in forever. Great work, thank you so much! –  user5779 Nov 24 '11 at 16:01

1 Answer 1

up vote 4 down vote accepted

Check this out:

public static bool IsUserInRole(SPUser user, SPWeb web, string roleName)
        {
            SPPermissionInfo info = web.GetUserEffectivePermissionInfo(user.LoginName);
            SPRoleDefinition roleDefinition = web.RoleDefinitions[roleName];

            foreach (SPRoleAssignment roleAssignment in info.RoleAssignments)
            {
                if (roleAssignment.RoleDefinitionBindings.Contains(roleDefinition))
                    return true;
            }

            return false;
        }
share|improve this answer
    
Should this work? It doesn't seem to work for me. –  Jasper Oct 19 '11 at 13:51
    
I already tested it.You get any error? –  Amit Kumawat Oct 19 '11 at 14:04
    
Yeah, when I'm logged in as an FBA user and I try to do this call, I get an error page instantly. Doesn't matter if I run it elevated or not, access is being denied. It does work when I'm logged in as a site admin, but then it doesn't seem to return the rights inherited by the domain group. –  Jasper Oct 19 '11 at 14:39
1  
Sorry my bad. I was using the SPContext.Current.Web object for checking, and since that is initialized as the current user, there were insufficient permissions to enumerate the rights. Getting the corrent site/web inside the RunWithElevatedPrivileges fixed this. Works great, thanks! –  Jasper Oct 19 '11 at 15:12
    
I updated the code to handle the case when a user is assigned to many groups. Please note. –  Amit Kumawat Oct 21 '11 at 5:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.