Getting SharePoint list item level permissions with C# CSOM

Question

I am developing some C# CSOM code that sets item level (folder) permissions in a SharePoint 2016 on premise document library. I am successful in assigning groups to folders, and some folders have subfolders that break inheritance and have a different group than their parent folder. After setting permissions on all folders, I run the following code to identify the groups assigned to each folder:

ListItems = docLibrary.GetItems(CamlQuery.CreateAllItemsQuery());
                clientContext.Load(ListItems, a => a.IncludeWithDefaultProperties(b => b.HasUniqueRoleAssignments, b => b.Folder, b => b.Folder.Name
                    , b => b.DisplayName, b => b["FileRef"], b => b["FileLeafRef"]),
                    permsn => permsn.Include(a => a.RoleAssignments.Include(roleAsg => roleAsg.Member.LoginName,
                            roleAsg => roleAsg.RoleDefinitionBindings.Include(roleDef => roleDef.Name,
                            roleDef => roleDef.Description))));
                clientContext.ExecuteQuery();

Then examine the role assignments, I expect to see one role assignment for the parent folder because I have assigned only one group to that folder. But I’m seeing (in one case) 45 role assignments which (I think) represents that total number of role assignments for all sub folders of the parent folder. Like this:

And I don't know how to interrogate the role assignments to figure out which folder they are associated with. Can you help me to identify only the group assign to a particular folder? Thanks!

Answer 1

You have loaded RoleAssignments for corresponding item, so you could confirm it by checking item's permission(Share->Manage Access->Advanced).

Answer 2

You can try the below code:

ClientContext ctx = new ClientContext("http://server:port/sites/test");
Web web = ctx.Web;
List test = web.Lists.GetByTitle("Test Docs");
ListItemCollection itemColl = test.GetItems(CamlQuery.CreateAllFoldersQuery());
ctx.Load(itemColl, x => x.Include(
                       y => y.RoleAssignments.Include(z => z.Member),
                       y => y.DisplayName));
ctx.ExecuteQuery();

foreach (ListItem item in itemColl) 
{
    Console.Write(item.DisplayName + " folder permissions are: ");
    foreach (RoleAssignment role in item.RoleAssignments)
    { 
        Console.Write(role.Member.Title + "\t");
    }
    Console.WriteLine("\n\n");
}

Similar question is discussed here :

How to get SharePoint Group Names having permission on Folder in SharePoint 2010