Adding user to a SP group via REST api - some sites return 401 "Access Denied" but the code succeeds

Question

I guess this is very specific so might be hard to find someone who has a clue - but it's worth trying.

I have a simple console app in c# that adds AD groups to existing SP security groups using REST api. What it does it only POSTs to following url: /_api/web/sitegroups(x)/users (it also includes a form digest value in X-RequestDigest header).

This works fine in my company's environment. This also works on one test site in the client's environment, but in all other sites a WebException is thrown with this error:

401 Unauthorized and inside there is a message: "Access denied. You do not have permission to perform this action or access this resource”.

What's even more interesting: the group is added successfully! Why is the exception thrown then...?

This is very strange as the user that is running the tool can access those sites and can add users to those groups via browser. He has full permissions on those sites. What's happening?

Answer 1

In case someone else runs into this issue, it most likely doesn't have to do with the USER's permissions, but the actual workflow (workflows don't inherit permissions from the user - but instead run on their own permissions)

I could be wrong about the actual explanation, but if you add the actual HTTP request inside an App Step (so it increases permissions) - the step should work (however it's weird that it throws an error and works anyway) so I could be way off

Answer 2

I had a similar issue when comparing permission levels. Try verifying that the group settings for "Who can view/edit the membership of the group?" for each group is set correctly.

Answer 3

As warmfire540 indicated, workflows do not inherit user permissions so you need to configure such updates in an App Step as follows:

1. Click the Settings icon.
2. Go to Site Settings.
3. In the Site Actions section, select Manage site features.
4. Locate the feature called Workflows can use app permissions, and then click Activate.
5. FromSite Settings,In the Users and Permissions section, select Site app permissions.
6. Copy the client section of the App Identifier. This is the identifier between the last "|" and the "@" sign.
7. Navigate to the Grant permission to an app page. This must be done by browsing to the appinv.aspx page of the site i.e. http://{hostname}/{the Site Collection}/_layouts/15/appinv.aspx.
8. Paste the client id in the App Id field and then click Lookup.
9. Paste the following Permissions Request XML to grant full control permission.
10. <AppPermissionRequests> <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" /> </AppPermissionRequests>
11. Click Create.
12. You will then be asked to trust the Workflow app. Click Trust It.
13. Open the site in SharePoint Designer 2013.
14. Edit your failing workflow.
15. Insert an App Step.
16. Now embed your code that adds the security group inside the App Step.
17. Publish your workflow.

For a much more detailed explanation including screen shots, see the original article.

Answer 4

I had the same issue, except that I'm using REST in JavaScript from the browser directly. It looks like a bug and several people reported this issue on the Web, but without solutions...

After digging, it looks like the WebService works OK. So I used AddUserToGroup instead of REST API.

Answer 5

In addition to the previous answer check permissions of the user on SP site. See this post.