Right Management

Question

I'm planing a sharepoint application. One part of the solution should be a list. Each list item should have two persons who are allowed to make changes on it (plus two Administratorgroups). The persons who are allowed to do changes aren't the same and for each item and could be changed by the user (the list has two fields Admin1 and Admin2)

My idea was: To create a list a event-receiver. Always when a list item is created or changed I remove all permissions of a item and add permissions to the Admin1 and Admin2.

My Code:

     public override void ItemAdded(SPItemEventProperties properties)
     {
       setPermissions(properties);
       base.ItemAdded(properties);
     }

     private void setPermissions(SPItemEventProperties properties)
     {
       SPListItem item = properties.ListItem;
       foreach(SPRoleAssignment permission in item.RoleAssignments)
       {
           Permissions.RemovePermissions(item, permission.Member as SPPrincipal);
       }

     SPSite site = new SPSite(properties.WebUrl);
     SPWeb web = site.OpenWeb();
     SPRoleDefinition readDef = web.RoleDefinitions["Vollzugriff"];
     var username = properties.ListItem["Admin1"].ToString();
     user = web.AllUsers[username];
     SetPermissions(item, user as SPPrincipal, readDef);
     username = properties.ListItem["Admin2"].ToString();
     user = web.AllUsers[username];
     SetPermissions(item, user as SPPrincipal, readDef);
     }

    public static void RemovePermissions(this SPListItem item, SPPrincipal principal)
    {
        if (item != null)
        {
            item.BreakRoleInheritance(true);
            item.RoleAssignments.Remove(principal);
            item.BreakRoleInheritance(false);
            //item.SystemUpdate();
        }
    }

    public static void SetPermissions(this SPListItem item, SPPrincipal principal, SPRoleDefinition roleDefinition)
    {
     if (item != null)
     {
      SPRoleAssignment roleAssignment = new SPRoleAssignment(principal);

      roleAssignment.RoleDefinitionBindings.Add(roleDefinition);

         //deactivate Inhertinace 
      item.BreakRoleInheritance(true);
      item.RoleAssignments.Add(roleAssignment);
      item.BreakRoleInheritance(false);
     }
    }

I'm not really shure if it is best practise, espacilly because of dectivating inheritance and activating it again. And I'm alway get a error: I do not have permissions on the rights of a object.

Does anyone has en idea how it would be best practise and how to solve this problem?

Thanks a lot!!!

ps: the solution is deployed as a sandbox solution

Edit: @AlexSSE: Thanks, I'm allready registering the event receiver by a feature elemts file. The ItemAdded-method get activated. The error comes from item.RoleAssignments (-> no permissions) The Permissions should look like this:

Item1

• user1
• user2
• AdminGroup1
• AdminGroup2

Item2

• user3
• user2
• AdminGroup1
• AdminGroup2

Answer 1

Consider security mechanism in Sandboxed Solutions

Especially the following:

You cannot use the object model to register event receivers within sandboxed solutions. For example, you cannot use a feature receiver class to register an event receiver on feature activation. However, you can register event receivers declaratively in your feature elements file.

As for the approach in this particular situation: can you clarify why can't you declare 2 Admin groups and add user manually to them?