How to add an AD group to a SP group using REST api?

Question

I managed to write a code that adds a user to SP group using REST and it just posts this data:

{ '__metadata': { 'type': 'SP.User' }, 'LoginName':'i:0#.w|domain\\user' }  

to here:
/_api/web/sitegroups(x)/users which is pretty cool and works.

But I need to add AD groups instead of users to this SP group. I learned that I can do it in a similar way if instead I post this data (provided that I know the group's "login"):

{ '__metadata': { 'type': 'SP.Group' }, 'LoginName':'c:0+.w|s-1-5-21-1957994488-842925246-40105171-1317994' }  

Nice, but how do I get this login name of a group? I cannot find a place where I could just ask "hey SharePoint, give me the login I can use for a group named XXX".

Is there a way to determine this "login" or a different way to add an AD group to a SP security group?

Answer 1

The login name you are mentioning is called SID of Active Directory objects. I am afraid there is no client side api which can query AD.

Using powershell you can retrieve this information as

$adObj = New-Object System.Security.Principal.NTAccount('ADGroupName')
$sid = $adObj.Translate([System.Security.Principal.SecurityIdentifier])
$sid

Answer 2

You could use the following REST query to retrieve AD groups (SecurityGroup type: 4):

/_api/web/siteusers?$filter=PrincipalType eq 4 

How to add AD Group into SP Group using SharePoint REST Interface

The following example demonstrates how to add AD Group named DOMAIN\Intranet-Owners into SharePoint Owners Group using JavaScript:

The solution consists of:

• Request AD Group by Title - see method getUserByTitle (the only purpose of this step is to retrieve SP.User details by Title , in particular LoginName )
• Add AD Group into SP Group - see method insertUserToGroup. Note: AD Group is added into SP Group as SP.User entity

Example:

function createJson(url,payload) 
{
    return $.ajax({       
       url: url,   
       type: "POST",   
       data: JSON.stringify(payload),
       contentType: "application/json;odata=verbose",
       headers: { 
          "Accept": "application/json;odata=verbose",
          "X-RequestDigest" : $("#__REQUESTDIGEST").val()
       }
    });
}


function getJson(url) 
{
    return $.ajax({       
       url: url,   
       type: "GET",  
       contentType: "application/json;odata=verbose",
       headers: { 
          "Accept": "application/json;odata=verbose"
       }
    });
}


function insertUserToGroup(webUrl, userTitle,groupId)
{
    return getUserByTitle(webUrl,userTitle).then(function(data){
        var usersEndpointUrl = webUrl + "/_api/web/sitegroups(" + groupId + ")/users";
             if(data.d.results.length == 1) {
                 var user = data.d.results[0];
                 var usersPayload  = { '__metadata': { 'type': 'SP.User' }, 'LoginName': user.LoginName };  
                 return createJson(usersEndpointUrl,usersPayload);  
             }    
        });

}

function getUserByTitle(webUrl,title){
    var userEnpointUrl =  webUrl + "/_api/web/siteusers?$filter=Title eq '" + title + "'";
    return getJson(userEnpointUrl);
}

var ownersGroupId = 6;
var adGroupName = "DOMAIN\Intranet-Owners";
insertUserToGroup(_spPageContextInfo.webAbsoluteUrl,adGroupName,ownersGroupId)
.done(function()
{
    console.log('User has been added');
})
.fail(
function(error){
    console.log(JSON.stringify(error));
});

NOTE:

You may need to use the ensureUser webmethod instead of the siteUsers one, in case you notice that you are not getting results for the target user.