1

I have a workflow set on a list that will read a Person field, and I want this workflow to change the permissions of the user(s) in this column to have full access when they normally would only have read.

I've attempted this by taking tips from this page.

EDIT: The other requirement is that I want to avoid using the impersonation function as it is a feature of SP2010 and I plan to stick to SP2013 functionality which would be through REST calls.

EDIT2: I am trying to piece this all together and am starting with a simple item inheritance break, but when I Perform an HTTP POST with the call below, I receive the below error messages. I do not know why I am having a permissions issue or how to go about remedying this within a Workflow. I have full access to the list, so when I run the call it should have sufficient permissions.

https://synchrocenter.ad.selinc.com/sites/SELHome/_api/web/lists/getByTitle('TestList')/items([%Current Item:ID%])/breakroleinheritance(copyRoleAssignments=true,clearSubscopes=true)

Error:

Response Content: {"error":{"code":"-2147024891, System.UnauthorizedAccessException","message":{"lang":"en-US","value":"Access denied. You do not have permission to perform this action or access this resource."}}}

1

Mike's alternative is the easiest to implement.

You can also implement a Web Service to do the required actions for you

and lastly (and I guess what you really want), you can try to implement the calls listed in this article in successive HTTPSend activities.

The JQuery version of the REST calls are listed below.

// Change placeholder values before you run this code.
var siteUrl = 'http://server/site';
var listTitle = 'List 1';
var groupName = 'Group A';
var targetRoleDefinitionName = 'Contribute';
var groupId;
var targetRoleDefinitionId;

$(document).ready( function() {
    getTargetGroupId();
});

// Get the ID of the target group.
function getTargetGroupId() {
    $.ajax({
        url: siteUrl + '/_api/web/sitegroups/getbyname(\'' + groupName + '\')/id',
        type: 'GET',
        headers: { 'accept':'application/json;odata=verbose' },
        success: function(responseData) {
            groupId = responseData.d.Id;
            getTargetRoleDefinitionId();
        },
        error: errorHandler
   });
}

// Get the ID of the role definition that defines the permissions
// you want to assign to the group.
function getTargetRoleDefinitionId() {
    $.ajax({
        url: siteUrl + '/_api/web/roledefinitions/getbyname(\''
            + targetRoleDefinitionName + '\')/id',
        type: 'GET',
        headers: { 'accept':'application/json;odata=verbose' },
        success: function(responseData) {
            targetRoleDefinitionId = responseData.d.Id;
            breakRoleInheritanceOfList();
        },
        error: errorHandler
    });
}

// Break role inheritance on the list.
function breakRoleInheritanceOfList() {
    $.ajax({
        url: siteUrl + '/_api/web/lists/getbytitle(\'' + listTitle
            + '\')/breakroleinheritance(true)',
        type: 'POST',
        headers: { 'X-RequestDigest':$('#__REQUESTDIGEST').val() },
        success: deleteCurrentRoleForGroup,
        error: errorHandler
    });
}

// Remove the current role assignment for the group on the list.
function deleteCurrentRoleForGroup() {
    $.ajax({
        url: siteUrl + '/_api/web/lists/getbytitle(\'' + listTitle
            + '\')/roleassignments/getbyprincipalid(' + groupId + ')',
        type: 'POST',
        headers: { 
            'X-RequestDigest':$('#__REQUESTDIGEST').val(),
            'X-HTTP-Method':'DELETE'
        },
        success: setNewPermissionsForGroup,
        error: errorHandler
    });
}

// Add the new role assignment for the group on the list.
function setNewPermissionsForGroup() {
    $.ajax({
        url: siteUrl + '/_api/web/lists/getbytitle(\'' + listTitle
            + '\')/roleassignments/addroleassignment(principalid='
            + groupId + ',roledefid=' + targetRoleDefinitionId + ')',
        type: 'POST',
        headers: { 'X-RequestDigest':$('#__REQUESTDIGEST').val() },
        success: successHandler,
        error: errorHandler
    });
}

function successHandler() {
    alert('Request succeeded.');
} 

function errorHandler(xhr, ajaxOptions, thrownError) {
    alert('Request failed: ' + xhr.status + '\n' + thrownError + '\n' + xhr.responseText);
}
  • Thank you, I'll try to implement what is in that article, I want to have this implemented without relying on 2010 functionality in case the ability to use 2010 features is removed at some point in the future so this workflow will last. – cm2 Dec 11 '14 at 17:04
  • You can package the action as a Custom Workflow Activity as a Sandbox Solution - If you uncheck the IncludeAssemblyInPackage in the solution properties in visual studio you can deploy it to SPO and consume it from SPD. – Choggo Dec 11 '14 at 17:06
  • Interesting, so doing this you can effectively trigger jQuery code through the workflow? – cm2 Dec 11 '14 at 17:23
  • Saddly, no. The JQuery is for reference of what to include in the request headers and which urls to use on the Call HTTP actions. With visual studio you can package common workflow actions into blocks so they are easier to reuse. They still need to be workflow actions though. – Choggo Dec 11 '14 at 17:26
  • Question, I will generally be needing to set permissions for single users. If that is the case would principalid be that user's ID rather than a groupId? – cm2 Dec 11 '14 at 17:39
0

I've been able to apply unique permissions on a SharePoint 2013 list item by creating a new SharePoint 2010 workflow. This allows you to use an Impersonation Step. Here is a screenshot of the configuration for this step. As long as you've broken inheritance on your list this should work.

permission-workflow

  • Thank you for the reply! I am looking for a way to do this through REST api, as I'm trying to stick to SP2013 functionality. – cm2 Dec 11 '14 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.