Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a problem with user permission of users which are programmatically added to Sharepoint 2013 group using Client Object Model. The web application allows anonymous, but I also have a document library "Teacher Documents" with contribute permission only to a certain group (let's say "Teachers"), and I have added the user to the site's default member too (let's say "School Members"). The code works fine and the user was successfully added to both groups.

While it did look OK and the username was listed as the member of the groups, they still cannot contribute. When I checked, they do have the anonymous access on the document library but not the Contribute permission. Here's my code:

public static string AddUserToGroup(string siteURL, string groupName, string userName, string name, string email, NetworkCredential impersonateCredential)
        {
            try
            {
                ClientContext context = new ClientContext(siteURL);
                context.Credentials = impersonateCredential;

                Group oGroup = null;

                oGroup = context.Web.SiteGroups.GetByName(groupName);

                context.Load(oGroup);
                bool groupExists = false;

                try
                {
                    context.ExecuteQuery();
                    groupExists = true;
                }
                catch { }

                if (groupExists)
                {
                    UserCreationInformation userCreationInfo = new UserCreationInformation();
                    userCreationInfo.Email = email;
                    userCreationInfo.LoginName = userName;
                    userCreationInfo.Title = name;

                    bool userExists = false;

                    try
                    {
                        User checkUser = oGroup.Users.GetByLoginName(userName);
                        context.Load(checkUser);
                        context.ExecuteQuery();
                        userExists = true;
                    }
                    catch { }

                    if (!userExists)
                    {
                        User oUser = oGroup.Users.Add(userCreationInfo);
                        context.ExecuteQuery();
                    }
                }
                else
                {
                    return "No associated group assigned";
                }

                return "Member " + userName + " has been added to group.";
            }
            catch (Exception ex)
            {
                return ex.Message.ToString();
            }
        }

And here's how I call it:

string siteURL = "http://spfe01.gilang.com/";
string username = "spfe01\\budi.utomo";
string name = "Budi Utomo";
string email = "budi.utomo@spfe01.gilang.com";

NetworkCredential impersonateCredential = new NetworkCredential("username", "password", "spfe01");

AddUserToGroup(siteURL, "Teachers", username, name, email, impersonateCredential));

(You can test it on a console application)

It worked, the user was added to "Teachers", but no permission on "Teacher Documents" document library. Adding the user to the admin group "School Owners" with full control on the site did not work either. Any help is appreciated, thank you very much.

EDIT: In my case, I have added the group manually to the document library, and users that are added manually to the group are granted permissions and allowed to contribute. By manually I mean using the standard "Permissions" function of the Sharepoint on the web browser.

share|improve this question
    
If the user was added to the group, it must have all the rights of the Group.. Can you double check if the Document Library Permissions are inheriting Site Permissions! –  Arsalan Adam Khatri Dec 2 '12 at 14:00
    
Thanks for your reply. The document library is not inheriting permissions from the site (has unique permissions). Does it mean that if the document library stops inheriting permission from the site, then the group would not have the permission on it? –  Gilang Bhagaskara Dec 3 '12 at 4:07
add comment

2 Answers 2

On top of what @ArsalanAdamKhatri said, if the user is in the group they should have an identity, and should not be anonymous.

Anonymous users are not able to create or edit documents in a document library. If your user is showing as anonymous, there's your answer. They need to be authenticated to add new documents or edit existing documents. With anonymous access turned on your users will only have read permissions.

If you have anonymous access enabled on the web application, you will have to extend the web application and have one web app use your normal authentication method, while using the "other" web app for anonymous access.

This behavior is by design.

share|improve this answer
    
Yes, when I checked the permission, the user has "None" permission. However, it shows that the user has Anonymous access: "Permission levels given to Budi Utomo (i:0#.w|spfe01\budi.utomo) None Anonymous Access. View Items, Open Items, View Versions, View Application Pages, Use Client Integration Features, Open". I take it that I will have to build a new web application with anonymous access, but unfortunately I am limited to using only one that allows anonymous access. Thanks. –  Gilang Bhagaskara Dec 3 '12 at 4:14
    
You just need to extend the web application into another zone. Have one zone be your normal authentication. Have the other allow anonymous access. –  RJ Cuthbertson Dec 3 '12 at 14:12
add comment
up vote 0 down vote accepted

I have managed to solve this. Using C# client object model, it seemed to be fine until I ran into this strange problem. A friend helped me create a method to invoke a Powershell script instead, which uses the same algorithm and functions as client object model. Strange, it was the same function, but using powershell seems to be more powerful.

Here's how we did it:

public static Collection<PSObject> AddUserToSharePointGroup(string Domain, string UserName, string GroupName, string SiteUrl)
    {
        String User = Domain + "\\" + UserName;
        Collection<PSObject> Result = null;
        PSCredential SharePointPSCredUser = new PSCredential(AuthenticationHelper.SharePointUsername, AuthenticationHelper.SharepointPassword);

        WSManConnectionInfo SharePointPSConnection = new WSManConnectionInfo(new Uri(AuthenticationHelper.SharePointLiveIdConnectionUri), AuthenticationHelper.SharePointPSSchema, SharePointPSCredUser);
        SharePointPSConnection.AuthenticationMechanism = AuthenticationMechanism.Credssp;

        Runspace RunSpace = RunspaceFactory.CreateRunspace(SharePointPSConnection);

        string script = "Add-PSSnapin -Name Microsoft.SharePoint.PowerShell; [Microsoft.SharePoint.SPSecurity]::RunWithElevatedPrivileges({ New-SPUser -UserAlias '" + User + "' -Web '" + SiteUrl + "' -Group '" + GroupName + "' })";
        PowerShell PS = PowerShell.Create();
        PS.AddScript(script);

        try
        {
            RunSpace.Open();
            PS.Runspace = RunSpace;
            Result = PS.Invoke();
        }
        catch (Exception e)
        {
            throw new Exception("Error Exception: " + e.Message);
        }
        finally
        {
            RunSpace.Dispose();
            RunSpace = null;
            PS.Dispose();
            PS = null;
        }

        return Result;

    }

Thanks for your help, guys :)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.