11

Why does CurrentUser.IsSiteAdmin return false for a user that is listed in the site collection admin in SharePoint?

I am building an Office 365 app that accesses SharePoint via the REST api. During initial OAuth authentication, when I successfully gain access to SharePoint, I'm trying to get some information about the user to send to the app.

using (var ctx = TokenHelper.GetClientContextWithAccessToken(
    webUrl, sharePointAuthResult.AccessToken))
{
    var spWeb = ctx.Web;
    ctx.Load(spWeb, c => c.CurrentUser);
    ctx.ExecuteQuery();

    // Should return true but returns false
    var isAdmin = ctx.Web.CurrentUser.IsSiteAdmin;
}

My admin user has been added in SharePoint

12

Probably it occurs since you are using App-only policy type for authorization .

According to App authorization policy types in SharePoint 2013:

App-only policy—When the app-only policy is used, SharePoint checks only the permissions of the app principal. Authorization check succeeds only if the current app has sufficient permissions to perform the action in question, regardless of the permissions of the current user (if any).

In that case Web.CurrentUser returns App principal and not real user:

using (var ctx = TokenHelper.GetClientContextWithAccessToken(
    webUrl, sharePointAuthResult.AccessToken))
{
    var currentUser = ctx.Web.CurrentUser; // app principal(!)
    ctx.Load(currentUser);
    ctx.ExecuteQuery();
}

To determine whether user is site collection administrator you could try to request the user first:

using (var ctx = TokenHelper.GetClientContextWithAccessToken(webUri.ToString(), accessToken))
{

    var user = ctx.Web.EnsureUser(accountName);
    ctx.Load(user);
    ctx.ExecuteQuery();
    var isAdmin = user.IsSiteAdmin;
}  

Update

Another way to determine whether user is site collection administrator

Supported in SharePoint 2010/2013

public static bool IsUserSiteAdmin(ClientContext ctx,int userId)
{
   var userInfoList = ctx.Site.RootWeb.SiteUserInfoList;
   var item = userInfoList.GetItemById(userId);
   ctx.Load(item);
   ctx.ExecuteQuery();
   return (bool)item["IsSiteAdmin"];
}                  

Usage

using (var ctx = new ClientContext(url))
{ 
     var currentUser = ctx.Web.CurrentUser;
     ctx.Load(currentUser);
     ctx.ExecuteQuery();

     var isCurrentUserSiteAdmin = IsUserSiteAdmin(ctx, currentUser.Id);
}
  • 1
    great response, thanks. Yeah, I think I ran into a situation similar to this where I was trying to retrieve a list of permissions for the given user, but I kept getting a 400-level error due to the same reason. I'll look into this today and get back to you with the results. Thanks! – Danny Bullis Jun 1 '15 at 18:05
  • unfortunately, that didn't work; IsSiteAdmin still returns false :/ – Danny Bullis Jun 2 '15 at 19:14
  • PrincipalType is "User" – Danny Bullis Jun 2 '15 at 19:21
  • 1
    I've no idea why User.IsSiteAdmin does not work as expected but you could try another approach (see updated answer) – Vadim Gremyachev Jun 5 '15 at 8:15
  • 1
    Nice, I see where you're going with that. I'll give that a shot when I get into the office on Monday. Thanks for your help man! I'll let you know how it goes. Cheers – Danny Bullis Jun 6 '15 at 18:09
1

I had the same symptoms on a SharePoint 2013 On Premise SP1 and October 2015 CU

problem was I ensured the user using the windows login name: domain\username e.g:

var user = clientContext.Web.EnsureUser("dev\administrator");

with this user, IsSiteAdmin returned False (he was definitely directly added to site collection admins) also with this user I did not get back any Groups associated.

then I tried to create a context with this user and used:

var user = clientContext.Web.CurrentUser;

now everything worked fine.

turns out, that you also need to use the claim part:

var user = clientContext.Web.EnsureUser("i:0#.w|dev\administrator");

now everything worked fine also with the ensured user -> IsSiteAdmin was true and all groups, where the user was added directly were fine.

Hope this helps others with the same issue - a real masterpiece powered by Microsoft :-)

0

Check if CurrentUser.IsSiteAuditor also returns false. CurrentUser.IsSiteAdmin will return false even if the user is Site Collection Administratior but not Site Collection Auditor.

  • I'm not seeing a IsSiteAuditor property on the CurrentUser – Danny Bullis May 29 '15 at 21:21
0

[SharePoint Online] I've had this problem too, it was not the App principal that was returned but the site admin as current user. The problem for me was that I had not yet added this to the app manifest:

  <AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
    <AppPermissionRequest Scope="http://sharepoint/search" Right="QueryAsUserIgnoreAppPrincipal" />
    <AppPermissionRequest Scope="http://sharepoint/taxonomy" Right="Read" />
  </AppPermissionRequests>

My guess is that you would only need the second AppPermissionRequest tag. Also, add this piece of code to permission request xml code on appinv.aspx (first lookup the app using the client id).

When I ran again, the IsSiteAdmin property was set to true.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.