Check users group membership via REST API using AD-Groups in SP-Groups

Question

I am aware that similar questions have been asked around here but none of them answers the part of AD-Groups that are used inside of SP-Groups.

I have several SP-Groups in my teamsite. I follow best practices and use existing Active Directory groups that are nested in the mentioned SP-Groups.

Now I need to check the group membership of the current user via REST. But everything I have tried only works with users that are direct members of a SP-Group.

Example:

http://mysharepoint/sites/test/_api/web/currentuser/groups

I also tried several other REST endpoints (sitegroups, siteusers etc.) but the response is always empty if the user performing it is only a member of an AD-Group that is nested inside the SP-Group.

So my question is if this is possible after all using the REST API? If not, would this be possible using CSOM?

Answer 1

At least there is a workaround that will work fine (although I don´t like workarounds). You can set the group setting "Who can view the membership of the group" in SP-Group-Settings to "Group Members". Then only members of the group can see the members of that group. Luckily you can ask if the current-user has the right to view a groups membership. So if the user can view the membership of the group then he/she must be a member (make sure to document this and that nobody can change this easily) of that group. Here is a request example:

http://<siteurl>/_api/web/sitegroups/getbyname('groupname')/CanCurrentUserViewMembership

OR

http://<siteurl>/_api/web/sitegroups(groupid)/CanCurrentUserViewMembership

Response is a simple boolean.

For me this will work. But I would be happy to learn if there is a more "correct" way.

Answer 2

I've used this technique before:

Add script editor webparts audience targeted to specific groups (audience targeting works with nested AD groups in SPGroups). Inside them set javascript variables which are used to determine what memberships the context user has.

Building on this, you could use a web job to check all groups (e.g. daily) on a web and then add a script editor webpart for each one onto a custom page, audience targeted to each group. Inside the script editor webparts, update cookie values. Then you just need to ensure you hit that page once every so often (e.g. in a hidden iframe daily) and then your code elsewhere on the site can go by the cookie values. This way, you don't need to actually maintain anything when you add or remove groups on the site.

Answer 3

as mentionned, nested security groups from Office 365 or Azure inside Sharepoint groups work as "security wise', but REST current user groups function does not. It will never return sharepoint group for current user.