13

I am aware that similar questions have been asked around here but none of them answers the part of AD-Groups that are used inside of SP-Groups.

I have several SP-Groups in my teamsite. I follow best practices and use existing Active Directory groups that are nested in the mentioned SP-Groups.

Now I need to check the group membership of the current user via REST. But everything I have tried only works with users that are direct members of a SP-Group.

Example:

http://mysharepoint/sites/test/_api/web/currentuser/groups

I also tried several other REST endpoints (sitegroups, siteusers etc.) but the response is always empty if the user performing it is only a member of an AD-Group that is nested inside the SP-Group.

So my question is if this is possible after all using the REST API? If not, would this be possible using CSOM?

15

At least there is a workaround that will work fine (although I don´t like workarounds). You can set the group setting "Who can view the membership of the group" in SP-Group-Settings to "Group Members". Then only members of the group can see the members of that group. Luckily you can ask if the current-user has the right to view a groups membership. So if the user can view the membership of the group then he/she must be a member (make sure to document this and that nobody can change this easily) of that group. Here is a request example:

http://<siteurl>/_api/web/sitegroups/getbyname('groupname')/CanCurrentUserViewMembership

OR

http://<siteurl>/_api/web/sitegroups(groupid)/CanCurrentUserViewMembership

Response is a simple boolean.

For me this will work. But I would be happy to learn if there is a more "correct" way.

  • 2
    /_api/web/currentUser?$select=Groups/Title&$expand=Groups, this will give back all the group name where user is added. – nbi Sep 3 '16 at 8:45
  • Above worked for me! – Kushan L Perera Oct 19 '16 at 3:15
  • 1
    Works! But I had to write it that way (your suggestion did not work for me): _api/web/currentUser/groups?$select=title – Worn Oct 21 '16 at 12:20
0

I've used this technique before:

Add script editor webparts audience targeted to specific groups (audience targeting works with nested AD groups in SPGroups). Inside them set javascript variables which are used to determine what memberships the context user has.

Building on this, you could use a web job to check all groups (e.g. daily) on a web and then add a script editor webpart for each one onto a custom page, audience targeted to each group. Inside the script editor webparts, update cookie values. Then you just need to ensure you hit that page once every so often (e.g. in a hidden iframe daily) and then your code elsewhere on the site can go by the cookie values. This way, you don't need to actually maintain anything when you add or remove groups on the site.

0

as mentionned, nested security groups from Office 365 or Azure inside Sharepoint groups work as "security wise', but REST current user groups function does not. It will never return sharepoint group for current user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.