SharePoint online read web users

Question

I have an Autohosted SharePoint 2013 App. Therefore I cannot use the Sharepoint built in People Picker controls.

My idea is to display all users which are available in the App/Web to display in a dropdown. I got the dropdown working fine with AjaxControlToolkit and jquery, but I have troubles retrieving the users.

If I use:

SP.UserCollection siteusers = cc.Web.SiteUsers;
cc.Load(siteusers);
cc.ExecuteQuery();

foreach (SP.User member in siteusers)
{

everything works fine if i give my app full permissions. But that is not what I need and also I do not want to use this permission as my app will never get published in the store that way. I tried setting Read permission to Web but then I get an Unauthorized Exception...

Can somebody tell me how to retriev all users from the Web or the App?

best regards Alex

Answer 1

the key here is to pass the client credentials to the current context! so use an account that would have privlages to search all users. You need to think of it this way... what if the user that your using doesnt have access to the group ect... thats why it works when you give a high privlage, create a new user account that would have high privlage to search through all users and groups. Then use that user within the context.

//create a new context to add the user
ClientContext cc = new ClientContext(weburl);

//make new secure string object
SecureString password = new SecureString();

//mask the password by looping each character 
foreach (char c in "PutYourPassword".ToCharArray()) password.AppendChar(c);

//set the credential of the account that has access to the client context
cc.Credentials = new SharePointOnlineCredentials(username, password);

//you should be able to get all users now from the web!
SP.UserCollection siteusers = cc.Web.SiteUsers;
cc.Load(siteusers);
cc.ExecuteQuery();

foreach (SP.User member in siteusers)
{

}

you need to replace 'PutYourPassword' with your password and username with the user account name.... this account should have sufficent access..... this way your using an account that you setup just for apps to perform tasks that requier elevation rather than giving admin level to the whole app (this method is similar to impersonation)