Adding SPUsers to SPGroups programmatically changes User ID

Question

In a SharePoint Online (Office 365) environment we created a Sandboxed WebPart to put SPUsers in SPGroups. The SPGroup is created on rootlevel and has been given permissions on a subsite. This Subsite doesn't inherit permissions. We only use 1 SiteCollection.

We use the following code to add the User:

    SPUser user = SPContext.Current.Site.RootWeb.EnsureUser(*loginname*);
    Guid siteID = SPContext.Current.Site.ID;
    Guid webID = SPContext.Current.Web.ID;
    using (SPSite site = new SPSite(siteID))
    {
        using (SPWeb web = site.OpenWeb(webID))
        {
           try
           {
               web.AllowUnsafeUpdates = true;

               //Get the group for this web
               SPGroup oeGroup = web.Groups[*myGroupName*];
               if (oeGroup == null) return false;

               //Add the User to the OE Group
               oeGroup.AddUser(user);
               oeGroup.Update();

            }
            catch (Exception ex)
            {
                //Error Handling
            }
            finally
            {
                web.AllowUnsafeUpdates = false;
            }
        }
    }

When I execute this code the ID of the user has changed afterwards. The ID (Used to lookup the User from the UserInfoList) of the user before this action is 24. After this action it's 4066. I can see that the user is in the correct Group. When I delete the user manually (using the UI) and put it back manually the ID is back to 24.

I need the correct ID (24) to make different lookups to the User in the entire site. When performing the action manually the ID is kept 24. Can anyone help me with this?

Answer 1

The code itself is rather strange. Why are you recreating already existent objects (I mean SPSite and SPWeb)? Based on my experience, this could lead to some rather weird heisenbugs, not to mention possible performance hit (especially if the procedure is called repeatedly from a loop).

Thuswise, the first thing I'd recommend is to avoid the needless creation of SharePoint objects and to get rid of the using's.

Next, as far as I know, site.RootWeb.EnsureUser and web.EnsureUser will provide the same result.

And the last thing: there are many different ways to get user by login. EnsureUser is only one of them. Why not to try to fetch the user directly from SPWeb.SiteUsers (or you can use SPWeb.AllUsers or SPWeb.Users - you can find their differences in MSDN). This approach garantees that user will not be created or recreated in any case. If this will not do for some reason, you can also try to query users from SPWeb.SiteUserInfoList.

So I suggest to try the following code (haven't tested it, so probably there are some typos):

string loginName = "*loginName*";
Guid site = SPContext.Current.Site;
Guid web = SPContext.Current.Web;
try
{
    web.AllowUnsafeUpdates = true;

    SPUser user = null;
    try
    {
        user = web.SiteUsers[loginName];
    }
    catch (SPException)
    {
        // User was not found. Let's try to create him
        user = web.EnsureUser(loginName);
    }

    //Get the group for this web
    SPGroup oeGroup = web.Groups["*myGroupName*"];
    if (oeGroup == null)
        return false;

    //Add the User to the OE Group
    oeGroup.AddUser(user);
    oeGroup.Update();

}
catch (Exception ex)
{
    //Error Handling
}
finally
{
    web.AllowUnsafeUpdates = false;
}

Answer 2

Thanks for all the replies everyone. At this point Microsoft marked it as bug and already patched it on the SharePoint Online environment.