CurrentUser.IsSiteAdmin should be true but returns false

Question

Why does CurrentUser.IsSiteAdmin return false for a user that is listed in the site collection admin in SharePoint?

I am building an Office 365 app that accesses SharePoint via the REST api. During initial OAuth authentication, when I successfully gain access to SharePoint, I'm trying to get some information about the user to send to the app.

using (var ctx = TokenHelper.GetClientContextWithAccessToken(
    webUrl, sharePointAuthResult.AccessToken))
{
    var spWeb = ctx.Web;
    ctx.Load(spWeb, c => c.CurrentUser);
    ctx.ExecuteQuery();

    // Should return true but returns false
    var isAdmin = ctx.Web.CurrentUser.IsSiteAdmin;
}

Answer 1

Probably it occurs since you are using App-only policy type for authorization .

According to App authorization policy types in SharePoint 2013:

App-only policy—When the app-only policy is used, SharePoint checks only the permissions of the app principal. Authorization check succeeds only if the current app has sufficient permissions to perform the action in question, regardless of the permissions of the current user (if any).

In that case Web.CurrentUser returns App principal and not real user:

using (var ctx = TokenHelper.GetClientContextWithAccessToken(
    webUrl, sharePointAuthResult.AccessToken))
{
    var currentUser = ctx.Web.CurrentUser; // app principal(!)
    ctx.Load(currentUser);
    ctx.ExecuteQuery();
}

To determine whether user is site collection administrator you could try to request the user first:

using (var ctx = TokenHelper.GetClientContextWithAccessToken(webUri.ToString(), accessToken))
{

    var user = ctx.Web.EnsureUser(accountName);
    ctx.Load(user);
    ctx.ExecuteQuery();
    var isAdmin = user.IsSiteAdmin;
}  

Update

Another way to determine whether user is site collection administrator

Supported in SharePoint 2010/2013

public static bool IsUserSiteAdmin(ClientContext ctx,int userId)
{
   var userInfoList = ctx.Site.RootWeb.SiteUserInfoList;
   var item = userInfoList.GetItemById(userId);
   ctx.Load(item);
   ctx.ExecuteQuery();
   return (bool)item["IsSiteAdmin"];
}                  

Usage

using (var ctx = new ClientContext(url))
{ 
     var currentUser = ctx.Web.CurrentUser;
     ctx.Load(currentUser);
     ctx.ExecuteQuery();

     var isCurrentUserSiteAdmin = IsUserSiteAdmin(ctx, currentUser.Id);
}

Answer 2

I had the same symptoms on a SharePoint 2013 On Premise SP1 and October 2015 CU

problem was I ensured the user using the windows login name: domain\username e.g:

var user = clientContext.Web.EnsureUser("dev\administrator");

with this user, IsSiteAdmin returned False (he was definitely directly added to site collection admins) also with this user I did not get back any Groups associated.

then I tried to create a context with this user and used:

var user = clientContext.Web.CurrentUser;

now everything worked fine.

turns out, that you also need to use the claim part:

var user = clientContext.Web.EnsureUser("i:0#.w|dev\administrator");

now everything worked fine also with the ensured user -> IsSiteAdmin was true and all groups, where the user was added directly were fine.

Hope this helps others with the same issue - a real masterpiece powered by Microsoft :-)

Answer 3

Check if CurrentUser.IsSiteAuditor also returns false. CurrentUser.IsSiteAdmin will return false even if the user is Site Collection Administratior but not Site Collection Auditor.

Answer 4

[SharePoint Online] I've had this problem too, it was not the App principal that was returned but the site admin as current user. The problem for me was that I had not yet added this to the app manifest:

  <AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
    <AppPermissionRequest Scope="http://sharepoint/search" Right="QueryAsUserIgnoreAppPrincipal" />
    <AppPermissionRequest Scope="http://sharepoint/taxonomy" Right="Read" />
  </AppPermissionRequests>

My guess is that you would only need the second AppPermissionRequest tag. Also, add this piece of code to permission request xml code on appinv.aspx (first lookup the app using the client id).

When I ran again, the IsSiteAdmin property was set to true.