Sharing Files/Folders REST API

Question

I'm currently using the REST API to upload files/folders and share the files with other users.

Files/Folders are being uploaded to the following:

https://tenant-my.sharepoint.com/personal/username_tenant_onmicrosoft_com/

To allow me to do this I have added a Admin account as an owner to the users site. When I make any calls to the API they are done through the Admin account. I couldn't find any way of impersonating a user.

When I have finished uploading and sharing the files and go to remove the admin account from the site and then login as the user it still shows the Admin account as having full control. However I can change the permissions of each file and folder.

All other permissions applied are there which is what I want.

Is there a cleaner way of doing this? Can I impersonate a user through the REST API?

Answer 1

You can't quite impersonate over REST API since the code runs client-side and any user could capture the request and use it maliciously to impersonate the user for other operations.

If you have a High-Trust (Provider Hosted) App SharePoint trusts who your signed token claims the user is, but even then, you shouldn't use it client side.

You might try using a High trust app that provides a web service that, when called, uses the C# CSOM to run the impersonated action.

I don't have much experience with SPO so I don't know how autohosted app behaves in regard to impersonation...

Answer 2

I've managed to accomplish this by doing the following. Once I've added my permissions to a folder or a file I do a clear up. I remove the role Full Control from the admin account.

When I go to remove the admin from the users site, the admin account no longer appears and no files are shared with the admin which is what I wanted.