Workaround for testing to see if a user belongs to Active Directory (AD) group within standard SP Group

Question

I recently implemented a JS/jQuery solution that checks for all of the SP groups to which a user belongs adds the group names classes to the body tag of the pages I am building. It worked very well until I ran into the problem of users belonging to an Active Directory (AD) group within the SP group. The solution failed to recognize when a user wasn't explicitly added to the SP group but still "belonged" via the AD group.

In prowling around for another solution, I stumbled on this answer to a similar question, in which a workaround was suggested but untested. That workaround would look something like:

• Create a SP List
• Break list inheritance from other SP groups and only allow one group to access it.
• Attempt to access the list using the SP REST API
• On Success, add a class to the body tag
• On Failure, no nothing.

To do that, I am guessing that I would need to do something like the following. (Adapted from this post here.)

ExecuteOrDelayUntilScriptLoaded(CheckList, "sp.js");

function CheckList() {
  context = new SP.ClientContext.get_current();
  lstStudents = context.get_web().get_lists().getByTitle('MyListNameHere');
  web = context.get_web();
  currentUser = web.get_currentUser();
  var groups = currentUser.get_groups();
  context.load(currentUser);
  context.executeQueryAsync(Function.createDelegate(this, this.onSuccessMethod),
                          Function.createDelegate(this, this.onFailureMethod)); 
}
function onSuccessMethod(sender, args) {

   // Do something here that grabs an item from the list.
   // If we get this far, the user has permission to access the list
   // Add the group name to the body class.

}
function onFailureMethod()
{
   // User does not have access to the SP list
   // Therefore don't add the class to the body tag.    
}

At this point, I'm kinda tapped out in my SP knowledge. Am hoping that someone can help me fill in the gaps of the function?

Answer 1

As a workaround try to check for user permission on the list first, at least read permission.

For checking that use below mentioned API -

http://<siteurl>/_api/web/lists/getbytitle('L2')/EffectiveBasePermissions

More details are available here

If user have at least read permission do the next thing as required.

Answer 2

The following workaround will work if under your Group Settings -> Who can view the membership for this groups is set to Group Members (for all groups).

I used SP REST API, but similar can be done using JSOM. Following is the concept

1. Extract all the groups in current site.
2. Loop through each group and check if user belongs to that group or not (this will be valid if you have given permission to AD Group under SP Group).
3. If user belongs to that group, add it to an Array.
4. After all checking finished, check for the list permissions and if user has permission to the list print the Array we created in step 3.

Following is the code sample:

<script src="http://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.2.1.min.js"></script>


<script>
    var currentUserGroups = [];

    function GetAllSiteGroups(){
        $.getJSON("http://<your_site>/sites/test/_api/web/SiteGroups", function (allGroups){

            if( allGroups.value != null){
                $(document).ajaxStop(function(){
                    checkListPermission();
                });

                allGroups.value.forEach(function(item) {
                    checkMembership(item);
                });

            }
        });
    }

    function checkMembership(group){
        $.getJSON("http://<your_site>/sites/test/_api/web/SiteGroups/getbyid("+ group.Id +")/CanCurrentUserViewMembership", function(isMember){
            if(isMember.value != true){
                currentUserGroups.push({"Id": group.Id, "Title": group.Title});
            }
        });
    }

    function checkListPermission(){
        debugger;
        // Check for List Permission.
        // If user has permission on list print currentUserGroup array decalred above to your desired element.
    }
</script>