SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm adding items to my list by powershell script. I need to fine-grain user permissions to added items.

Code I'm using now:

$claim = New-SPClaimsPrincipal -ClaimValue $role -ClaimType $ROLE_CLAIM -TrustedIdentityTokenIssuer $sts
    [Microsoft.SharePoint.SPRoleAssignment] $roleAssignment = New-Object Microsoft.SharePoint.SPRoleAssignment($claim.ToEncodedString(), "", $role, "")

This works when I'm assigning Full Control to administrators. But I'd like also other users to be able to read all items from the list. So I thought I'll add "All Authenticated Users" (like in people picker) read permission. The thing is that I don't what ClaimValue and ClaimType I have to pass to New-SPClaimsPrincipal cmdlet. Any ideas?

share|improve this question
Can you post the values of $role and $ROLE_CLAIM? – Sam Huggill Nov 10 '11 at 10:59
I don't know either, but if you assign All Users in the browser, can you grab the values in POSH? – Paul Schaeflein Jan 5 '12 at 17:03
up vote 13 down vote accepted

To get claim for All Authenticated Users in PS you need to use:

$claim = New-SPClaimsPrincipal -EncodedClaim "c:0(.s|true"

for windows users (NT AUTHORITY\authenticated users):

$claim = New-SPClaimsPrincipal -EncodedClaim "c:0!.s|windows"

and for all forms authenticated users (basic membership provider)

 $claim = New-SPClaimsPrincipal -EncodedClaim "c:0!.s|forms:aspnetsqlmembershipprovider" 

After that you can create role assignment like in code you provided and add it to item (I didn't test it myself).

And I still cannot believe that MSDN Forum has nice and simple answer to it here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.