2

I managed to write a code that adds a user to SP group using REST and it just posts this data:

{ '__metadata': { 'type': 'SP.User' }, 'LoginName':'i:0#.w|domain\\user' }  

to here:
/_api/web/sitegroups(x)/users which is pretty cool and works.

But I need to add AD groups instead of users to this SP group. I learned that I can do it in a similar way if instead I post this data (provided that I know the group's "login"):

{ '__metadata': { 'type': 'SP.Group' }, 'LoginName':'c:0+.w|s-1-5-21-1957994488-842925246-40105171-1317994' }  

Nice, but how do I get this login name of a group? I cannot find a place where I could just ask "hey SharePoint, give me the login I can use for a group named XXX".

Is there a way to determine this "login" or a different way to add an AD group to a SP security group?

2

The login name you are mentioning is called SID of Active Directory objects. I am afraid there is no client side api which can query AD.

Using powershell you can retrieve this information as

$adObj = New-Object System.Security.Principal.NTAccount('ADGroupName')
$sid = $adObj.Translate([System.Security.Principal.SecurityIdentifier])
$sid
3

You could use the following REST query to retrieve AD groups (SecurityGroup type: 4):

/_api/web/siteusers?$filter=PrincipalType eq 4 

How to add AD Group into SP Group using SharePoint REST Interface

The following example demonstrates how to add AD Group named DOMAIN\Intranet-Owners into SharePoint Owners Group using JavaScript:

The solution consists of:

  • Request AD Group by Title - see method getUserByTitle (the only purpose of this step is to retrieve SP.User details by Title , in particular LoginName )
  • Add AD Group into SP Group - see method insertUserToGroup. Note: AD Group is added into SP Group as SP.User entity

Example:

function createJson(url,payload) 
{
    return $.ajax({       
       url: url,   
       type: "POST",   
       data: JSON.stringify(payload),
       contentType: "application/json;odata=verbose",
       headers: { 
          "Accept": "application/json;odata=verbose",
          "X-RequestDigest" : $("#__REQUESTDIGEST").val()
       }
    });
}


function getJson(url) 
{
    return $.ajax({       
       url: url,   
       type: "GET",  
       contentType: "application/json;odata=verbose",
       headers: { 
          "Accept": "application/json;odata=verbose"
       }
    });
}


function insertUserToGroup(webUrl, userTitle,groupId)
{
    return getUserByTitle(webUrl,userTitle).then(function(data){
        var usersEndpointUrl = webUrl + "/_api/web/sitegroups(" + groupId + ")/users";
             if(data.d.results.length == 1) {
                 var user = data.d.results[0];
                 var usersPayload  = { '__metadata': { 'type': 'SP.User' }, 'LoginName': user.LoginName };  
                 return createJson(usersEndpointUrl,usersPayload);  
             }    
        });

}

function getUserByTitle(webUrl,title){
    var userEnpointUrl =  webUrl + "/_api/web/siteusers?$filter=Title eq '" + title + "'";
    return getJson(userEnpointUrl);
}

var ownersGroupId = 6;
var adGroupName = "DOMAIN\Intranet-Owners";
insertUserToGroup(_spPageContextInfo.webAbsoluteUrl,adGroupName,ownersGroupId)
.done(function()
{
    console.log('User has been added');
})
.fail(
function(error){
    console.log(JSON.stringify(error));
});

NOTE:

You may need to use the ensureUser webmethod instead of the siteUsers one, in case you notice that you are not getting results for the target user.

  • I think this works only if your group is visible in /web/siteusers - and there are only visible AD groups that you have used before, not all of them – agnieszka Nov 25 '14 at 12:14
  • I only tested it with AD group that is available in /web/siteusers and works for me. – Vadim Gremyachev Nov 25 '14 at 13:51
  • which does not solve a problem, because I need it working for any group. – agnieszka Nov 25 '14 at 16:21
  • I believe it is doable, to ensure AD group could be found, use SP.Web.ensureUser first. The good news it will still be client (REST) solution ;) – Vadim Gremyachev Nov 25 '14 at 17:23
  • Did you find away of getting a list of all AD User groups if they had not been added previously? Querying siteusers for me does not return anything – Webfort Dec 15 '14 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.