Grant Unique Permissions on List Item through Workflow

Question

I have a workflow set on a list that will read a Person field, and I want this workflow to change the permissions of the user(s) in this column to have full access when they normally would only have read.

I've attempted this by taking tips from this page.

EDIT: The other requirement is that I want to avoid using the impersonation function as it is a feature of SP2010 and I plan to stick to SP2013 functionality which would be through REST calls.

EDIT2: I am trying to piece this all together and am starting with a simple item inheritance break, but when I Perform an HTTP POST with the call below, I receive the below error messages. I do not know why I am having a permissions issue or how to go about remedying this within a Workflow. I have full access to the list, so when I run the call it should have sufficient permissions.

https://synchrocenter.ad.selinc.com/sites/SELHome/_api/web/lists/getByTitle('TestList')/items([%Current Item:ID%])/breakroleinheritance(copyRoleAssignments=true,clearSubscopes=true)

Error:

Response Content: {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

Answer 1

Mike's alternative is the easiest to implement.

You can also implement a Web Service to do the required actions for you

and lastly (and I guess what you really want), you can try to implement the calls listed in this article in successive HTTPSend activities.

The JQuery version of the REST calls are listed below.

// Change placeholder values before you run this code.
var siteUrl = 'http://server/site';
var listTitle = 'List 1';
var groupName = 'Group A';
var targetRoleDefinitionName = 'Contribute';
var groupId;
var targetRoleDefinitionId;

$(document).ready( function() {
    getTargetGroupId();
});

// Get the ID of the target group.
function getTargetGroupId() {
    $.ajax({
        url: siteUrl + '/_api/web/sitegroups/getbyname(\'' + groupName + '\')/id',
        type: 'GET',
        headers: { 'accept':'application/json;odata=verbose' },
        success: function(responseData) {
            groupId = responseData.d.Id;
            getTargetRoleDefinitionId();
        },
        error: errorHandler
   });
}

// Get the ID of the role definition that defines the permissions
// you want to assign to the group.
function getTargetRoleDefinitionId() {
    $.ajax({
        url: siteUrl + '/_api/web/roledefinitions/getbyname(\''
            + targetRoleDefinitionName + '\')/id',
        type: 'GET',
        headers: { 'accept':'application/json;odata=verbose' },
        success: function(responseData) {
            targetRoleDefinitionId = responseData.d.Id;
            breakRoleInheritanceOfList();
        },
        error: errorHandler
    });
}

// Break role inheritance on the list.
function breakRoleInheritanceOfList() {
    $.ajax({
        url: siteUrl + '/_api/web/lists/getbytitle(\'' + listTitle
            + '\')/breakroleinheritance(true)',
        type: 'POST',
        headers: { 'X-RequestDigest':$('#__REQUESTDIGEST').val() },
        success: deleteCurrentRoleForGroup,
        error: errorHandler
    });
}

// Remove the current role assignment for the group on the list.
function deleteCurrentRoleForGroup() {
    $.ajax({
        url: siteUrl + '/_api/web/lists/getbytitle(\'' + listTitle
            + '\')/roleassignments/getbyprincipalid(' + groupId + ')',
        type: 'POST',
        headers: { 
            'X-RequestDigest':$('#__REQUESTDIGEST').val(),
            'X-HTTP-Method':'DELETE'
        },
        success: setNewPermissionsForGroup,
        error: errorHandler
    });
}

// Add the new role assignment for the group on the list.
function setNewPermissionsForGroup() {
    $.ajax({
        url: siteUrl + '/_api/web/lists/getbytitle(\'' + listTitle
            + '\')/roleassignments/addroleassignment(principalid='
            + groupId + ',roledefid=' + targetRoleDefinitionId + ')',
        type: 'POST',
        headers: { 'X-RequestDigest':$('#__REQUESTDIGEST').val() },
        success: successHandler,
        error: errorHandler
    });
}

function successHandler() {
    alert('Request succeeded.');
} 

function errorHandler(xhr, ajaxOptions, thrownError) {
    alert('Request failed: ' + xhr.status + '\n' + thrownError + '\n' + xhr.responseText);
}

Answer 2

I've been able to apply unique permissions on a SharePoint 2013 list item by creating a new SharePoint 2010 workflow. This allows you to use an Impersonation Step. Here is a screenshot of the configuration for this step. As long as you've broken inheritance on your list this should work.