13

I am aware that similar questions have been asked around here but none of them answers the part of AD-Groups that are used inside of SP-Groups.

I have several SP-Groups in my teamsite. I follow best practices and use existing Active Directory groups that are nested in the mentioned SP-Groups.

Now I need to check the group membership of the current user via REST. But everything I have tried only works with users that are direct members of a SP-Group.

Example:

http://mysharepoint/sites/test/_api/web/currentuser/groups

I also tried several other REST endpoints (sitegroups, siteusers etc.) but the response is always empty if the user performing it is only a member of an AD-Group that is nested inside the SP-Group.

So my question is if this is possible after all using the REST API? If not, would this be possible using CSOM?

4 Answers 4

17

At least there is a workaround that will work fine (although I don´t like workarounds). You can set the group setting "Who can view the membership of the group" in SP-Group-Settings to "Group Members". Then only members of the group can see the members of that group. Luckily you can ask if the current-user has the right to view a groups membership. So if the user can view the membership of the group then he/she must be a member (make sure to document this and that nobody can change this easily) of that group. Here is a request example:

http://<siteurl>/_api/web/sitegroups/getbyname('groupname')/CanCurrentUserViewMembership

OR

http://<siteurl>/_api/web/sitegroups(groupid)/CanCurrentUserViewMembership

Response is a simple boolean.

For me this will work. But I would be happy to learn if there is a more "correct" way.

4
  • 2
    /_api/web/currentUser?$select=Groups/Title&$expand=Groups, this will give back all the group name where user is added.
    – nbi
    Commented Sep 3, 2016 at 8:45
  • Above worked for me! Commented Oct 19, 2016 at 3:15
  • 2
    Works! But I had to write it that way (your suggestion did not work for me): _api/web/currentUser/groups?$select=title
    – Worn
    Commented Oct 21, 2016 at 12:20
  • As of today, the better approach is to use Graph API. Commented Jun 11 at 12:26
1

as mentionned, nested security groups from Office 365 or Azure inside Sharepoint groups work as "security wise', but REST current user groups function does not. It will never return sharepoint group for current user.

0

I've used this technique before:

Add script editor webparts audience targeted to specific groups (audience targeting works with nested AD groups in SPGroups). Inside them set javascript variables which are used to determine what memberships the context user has.

Building on this, you could use a web job to check all groups (e.g. daily) on a web and then add a script editor webpart for each one onto a custom page, audience targeted to each group. Inside the script editor webparts, update cookie values. Then you just need to ensure you hit that page once every so often (e.g. in a hidden iframe daily) and then your code elsewhere on the site can go by the cookie values. This way, you don't need to actually maintain anything when you add or remove groups on the site.

0

We can use Graph API to achieve this requirement in SPFx. There are multiple endpoints in Graph API which we can use for this specific scenario.

  • all AD groups I belong to (direct or indirect membership) reference

https://graph.microsoft.com/v1.0/me/transitiveMemberOf/microsoft.graph.group

https://graph.microsoft.com/v1.0/groups/{group-id}/members

The group id can be obtained from user information page from SharePoint by clicking on the AD Group name.

enter image description here

If you are using https://graph.microsoft.com/v1.0/groups endpoint in the solution, then it is required to provide the GroupMember.Read.All from API Access page.

If you are using https://graph.microsoft.com/v1.0/me/transitiveMemberOf endpoint in the solution, we can achieve this without providing any API Access approval from SharePoint admin (reason mentioned in screenshot below) - but the API response will contain only the IDs of groups the current user is a part of. For additional details in response, the API access to be provided reference.

enter image description here

How to use MS Graph in SPFx solution can be learned from here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.