Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I want to use a workflow to remove permissions on a calendar event/list item (with a category RPL) for all groups except group 'B' when the calendar event is created. Here is what i have so far but it blew up when i added the role assignment....looking for reccomendations.

private void onWorkflowActivated1_Invoked(object sender, ExternalDataEventArgs e)
    {
        string url = workflowProperties.WebUrl;
        SPSite site = new SPSite(url);
        SPWeb rootWeb = site.RootWeb;
        SPListItem li = workflowProperties.Item;

        SPRoleDefinitionCollection assignedRole = rootWeb.RoleDefinitions;            

        if (li["Category"].ToString().Equals("RPL"))
        {
            if (!li.HasUniqueRoleAssignments)
            {
                li.BreakRoleInheritance(false, true);
            }

            foreach (SPGroup g in rootWeb.Groups)
            {
                if (!g.Name.Equals("B"))
                {
                    SPRoleAssignment roleAssignment = new SPRoleAssignment(g);

                    roleAssignment.RoleDefinitionBindings.RemoveAll();

                    li.RoleAssignments.Add(roleAssignment);
                    li.Update();
                }
            }
        }
    }
share|improve this question
    
See this post. It describes how to add the unique permissions correctly. –  Alexander Apr 7 '12 at 15:55
    
Are you trying to give it a different Role (ex: Read vs Contribute)? –  Kit Menke Apr 9 '12 at 14:45
    
Didn't think about it but when i break inheritance only the item creator has permission on the item. So all i needed to do was assign my custom role definition to the group in question and all was good. –  MikeC Apr 9 '12 at 16:53

2 Answers 2

I have a helper function that lets me give a role to particular item. The trick is to check if the SPPrincipal already has a role, and remove that role if it does.

if (exists)
{
    // the group should only have the role that was specified
    // if we don't remove them all, it will do an "append"
    // ex: if it has Read and we are adding Contribute, will have
    // Read AND Contribute
    roleAssignment.RoleDefinitionBindings.RemoveAll();
}

SPRoleDefinition roleDefinition = web.RoleDefinitions[roleDefinitionName];
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);

The other thing to consider is that a workflow always runs as the current user.

  • If you are removing the permissions of the current user, it is very likely that you will run into issues.
  • If you are adding permissions, then you are probably OK

For example: I was making a workflow that updated a status field and then removed permissions to limit permissions to only an "admin" group. In the workflow, it would remove the permissions fine but then always fail... no matter what order my actions were in. It seems like it was doing a SPListItem.Update internally at the very end (which would always fail because the current user no longer had permission).

I eventually worked around this by always making an "Update with elevated privileges" action.

Also note, you can't run the workflow as the system account (after SP1). However, inside of a Workflow Action you can run with elevated privileges.

share|improve this answer
    
Can't you run a workflow with elevated permissions? –  Christophe Apr 9 '12 at 15:50
    
Not really.. check out my updated answer. –  Kit Menke Apr 9 '12 at 20:26

My two cents: using a workflow to restrict permissions when an item is created is usually a bad idea. Why? Because permissions are only applied after the item is created. Anybody who subscribes to alerts will be able to see the created item, before the workflow kicks in to restrict access.

share|improve this answer
    
I see your point.....this is a customer request (automate setting the permission on the calendar event)...i would be interested to know if there were a different way to automate that would restrict permission and alert.... –  MikeC Apr 9 '12 at 16:48
    
I've come across this issue a couple times and I don't have a miracle solution. The only way I can think of - but I haven't tried - is to 1/create a dummy item 2/Change permissions and 3/update the item with the actual data. –  Christophe Apr 9 '12 at 16:56
    
Probably an event receiver attached to the list would be the best option if you want to modify the item before it is actually created. –  Kit Menke Apr 11 '12 at 14:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.