Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have set my web permission to Inherit Permissions as well as Lists.and programmatically i have add SPUSER to web with assigned 'Restricted Read' access Role.

and also associate SPUSER to List1 list with Full control role.

my requirement is Users will be get access Role (Restricted Read) to Site and Role(Full control) to List1.

Here is my code:

 web.BreakRoleInheritance(true);
 web.AllowUnsafeUpdates = true;
 SPUser user = web.SiteUsers["domain\administrator"];
 if (user != null)
    {
           SPRoleDefinitionCollection WebRoles = web.RoleDefinitions;
           SPRoleAssignment roleassignweb = new SPRoleAssignment(user);
           roleassignweb.RoleDefinitionBindings.Add(WebRoles["Restricted Read"]);
           web.RoleAssignments.Add(roleassignweb);

           SPRoleAssignment roleAssignment = new SPRoleAssignment(user);
           roleAssignment.RoleDefinitionBindings.Add(WebRoles["Full Control"]);
            #region Assign Role To Requirement List.
                if (IsListExists(web, "List1"))
                   {
                      SPList oRequirement = web.Lists["List1"];
                      if (!oRequirement.HasUniqueRoleAssignments)
                         {
                           oRequirement.BreakRoleInheritance(true); // Ensure we don't inherit permissions from parent
                         }                            
                     oRequirement.RoleAssignments.Add(roleAssignment);
                     oRequirement.Update();
                   }
           #endregion

     }

My code run perfect. but user could not got Full Control access to List1. any idea?

share|improve this question
    
can you debug and check if your code is going through this code line, "oRequirement.BreakRoleInheritance(true); " –  Muhammad Raja Dec 28 '12 at 11:53

2 Answers 2

up vote 3 down vote accepted

As far as I know I never seen "Full control" premission level has been assigned to anyone other then System Account, however I think it will be better if you give user "Contribute" permissions as it will let them do most of things they need to do or you can create your own custom permission level.

We normally use SPRoleType to enumerate default permission levels and then add them to user of choice as shown below,

// Assuming you already have SPWeb and SPList objects
...
SPRoleAssignment roleAssignment = new SPRoleAssignment("dom\\user", "user@dom", "user", "some notes");
SPRoleDefinition roleDefinition = web.RoleDefinitions.GetByType(SPRoleType.Contributor);
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);
if (!myList.HasUniqueRoleAssignments)
{
    myList.BreakRoleInheritance(true); // Ensure we don't inherit permissions from parent
} 
myList.RoleAssignments.Add(roleAssignment);
myList.Update();

For More Information check this Link out

Hope it helps.

share|improve this answer
    
Hi,my List1 inherit permission with parent web. but when my code run. List1 break inherit permission.why this cause? bcz of BreakRoleInheritance(true) –  Jigs Dec 28 '12 at 18:15
    
yup, thats true, by default all objects inherit permissions but when you break inheritance, it doesn't inherit anymore from parent web –  Muhammad Raja Dec 28 '12 at 18:36
    
Its sound like.. Should i try use BreakRoleInheritance(false,false)? –  Jigs Dec 28 '12 at 18:46
    
I don't think if that will going to make any major difference, can you try putting your code in Elevated privilages might help, msdn.microsoft.com/en-us/library/bb466220(v=office.12).aspx –  Muhammad Raja Dec 28 '12 at 18:48
    
no luck.i have use my code in RunwithElevatedPrivilages :( –  Jigs Dec 28 '12 at 18:53

i dont know if timetothine has solved your issue or not as it should! but if it hasnt then you can do this! it will 100% work for you using impersonation! I used it for annonymous user who has no rights to anything appart for the public site. I need to write to a list that they dont have access to and so I came up with this:

SharePoint -access to path is denied

Just to clarifiy, runwithelevatedprivlages is not impersonation:

a good example is an anonymous user who you want to edit (add to) a sharepoint list that they dont have access to programmaticaly.

runwithelevatedprivlages will not work as anonymous users wouldnt have anything to elevate, this is where you need to impersonate an account that does have access. runwithelevatedprivlages works well with logged in users who dont have the right permissions.

as an example I will show you impersonation first:

to impersonate you need to get the system token first and make sharepoint think that your that person, anything within the spsite that your going to impersonate will be under that user and not the current user your using, the method below is getting the system account token with elevated privlages (for anonymous users):

/// <summary>
/// get the system token from the list of users to elevate spsite
/// </summary>
/// <param name="spSite"></param>
/// <returns></returns>
protected static SPUserToken GetSystemToken(SPSite spSite) 
{     
    SPUserToken res = null;     
    bool oldCatchAccessDeniedException = spSite.CatchAccessDeniedException;
    try
    {
        spSite.CatchAccessDeniedException = false;
        res = spSite.SystemAccount.UserToken;
    }
    catch (UnauthorizedAccessException)
    {
        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            using (SPSite elevatedSPSite = new SPSite(spSite.ID))
                res = elevatedSPSite.SystemAccount.UserToken;
            // (***)         
        });
    }
    finally    
    {         
        spSite.CatchAccessDeniedException = oldCatchAccessDeniedException;     
    }     
    return res; 
}

to use this method you would need to do the following:

        SPUserToken sysToken = null;
        using (SPSite spSite = new SPSite(SPContext.Current.Site.ID))
        {
            //get the system token from the method GetSystemToken and passing the spSite that you want to run under
            sysToken = GetSystemToken(spSite);

            using (SPSite impersonatedSite = new SPSite(siteUrl, sysToken))
            {
                //we are impersonating the [@"SHAREPOINT\SYSTEM"] account
                using (SPWeb web = impersonatedSite.OpenWeb())
                {
                     //do your code here as the impersonated account like updating a list
                }
            }
        }

this will work where RunWithElevatedPrivileges does not work :) as you can see there is suttle differences between the two, impersonation is not using the application pool account but rather any account that you want to impersonate. RunWithElevatedPrivileges only uses the application pool account and has some limitation to what access it has

msdn RunWithElevatedPrivileges explained

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.runwithelevatedprivileges.aspx

msdn Impersonation explained

http://msdn.microsoft.com/en-us/library/aa543158(v=office.14).aspx

http://msdn.microsoft.com/en-gb/library/windows/desktop/ms691341(v=vs.85).aspx

for the op, I would suggest as others and use RunWithElevatedPrivileges as it should be more than enough :)

hope this helps :)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.