How to Set Item Level Permission Using SharePoint Designer 2013 Work Flow?

Question

Currently i'm trying to create a workflow in SharePoint 2013 workflow platform that sets item level permission, trying to set read item level permission to "XYZ" group in SharePoint 2013 workflow

i have achieved same task in SharePoint 2010 workflow platform, now trying to create same in 2013,

How to set item level permission?

Answer 1

The simple process of setting item level permission is not available for SharePoint 2013 workflows. The only way I was able to do was through REST api called under Appstep.

There are 2 calls made:

1. BreakRoleInheritance
2. AddRoleAssignment

This blog by Yuri Leontyev​ ​ over at spssite.pro can be a good start.

Excerpt:

BreakRoleInheritance​

BreakRoleInheritance is just not documented and can be used using POST request:

https://your_sp_site.sharepoint.com/_api/web/lists/getByTitle('Test')/breakroleinheritance(copyRoleAssignments=true, clearSubscopes=true)

where copyRoleAssignments – “if true, this method copies the role assignments of the parent securable object when breaking inheritance; otherwise, this method adds the current user to the permission level that is required to manage the list item.” clearSubscopes – “Indicates whether subscopes should be cleared or not.”

AddRoleAssignment​​

Instead of the Add there is AddRoleAssignment method that also can be called using POST request (NOTE: this method works incorrectly in RTM release of SharePoint 2013!!!! It checks user within current item and if user is not found (usually as we’ve just broken inheritance) throws an exception. In SharePoint Online and March CU it works as expected):

https://your_sp_site.sharepoint.com/_api/web/lists/getByTitle('Test')/roleassignments/addroleassignment(principalid=20,roleDefId=1073741828) 

where principalid is id of user or group within current site collection. You can get a list of users by executing using GET:

https://your_sp_site.sharepoint.com/_api/web/siteusers

roleDefId is internal id of Role Definition (Read, Contribute, Full Control and so on). You can get a list of available role definitions using GET:

​https://your_sp_site.sharepoint.com/_api/web/roledefinitions​

Please use this guide to Enable App step in SharePoint 2013 Workflow, once you make sure all is set upped well the above solution will work fine.

facing some Error they are

Answer 2

Yeah, This is possible in workflow using REST API. Below are the steps which you need to follow.

Step 1: Whatever REST you are writing that should be part of App Step.

Step 2: As shown in screen shot you will have to write your commands in a workflow. There are some variables which you need to assign.

Step 3: Very first, you need to build dictionary where as variable name is ContextHeaders in aboveshown screenshot.

Step 4: Next need to set API url in very next line. That API url should be something like https://YourSite/_api/contextinfo and HTTP method should be HTTP Post.

Step 5: Next you need to set Get and that should be like d/GetContextWebInformation/FormDigestValue

Step 6: Again you need to build your dictionary for request headers to make REST call to break inheritance.

Step 7: Next you need to set variable to whom you want to give permissions after breaking the inheritance. In example shown above, we are assign some group ids to variable userIds.

Step 8: Write REST to break the inheritance. Your REST should look like https://YourSite/_api/web/lists/getByTitle(%27YourListTitle%27)/items(%27[%Current Item:ID%]%27)/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=true). HTTP Request Type will be HTTP POST.

As we are breaking item level inheritance that's why we are going with Current Item ID.

Step 9: You need to set variable roleDefinition. This role definition is for, what permission level you want to assign to particular user.group ID.

Step 10: For assigning unique permission to User/Group id, again you will have to make a REST call. your REST should look like https://YourSite/_api/web/lists/getByTitle(%27YoutListTitle%27)/items(%27[%Current Item:ID%]%27)/roleassignments/addroleassignment(principalid=[%Variable: Id%],roledefid=[%Variable: roleDefination%])

This is how you can break inheritance and assign unique permissions.

I hope this will help you. Still, if you have any thing, please write back.

Answer 3

I'd done this task with Designer workflow 2013 and REST API as follow reference sites - link [link2] (http://www.fabiangwilliams.com/2014/06/19/gotcha-on-sharepoint-designer-workflows-in-app-step/) Hope this should work for the same!!

Answer 4

Using out of the box workflow actions you can't do it because of security limitations. As solution I would like to suggest to have a look at a Plumsail Workflow Actions Pack. It is extended set of workflow actions for SharePoint Designer which also contains a set of workflow actions for permission management.

I'm one of developers of the product and I'm proud of it, that's why I recommend it.

Answer 5

You can use the REST API of SP2013 for this. The accepted answer fails to mention that you should of course provide your list item and not a list.

1) Break roleInheritance (official documentation)

url: _spPageContextInfo.siteServerRelativeUrl + "/_api/web/lists/GetByTitle('" + listTitle + "')/getitembyid(" + id + ")/breakroleinheritance(copyRoleAssignments=false, clearSubscopes=false)"

2) Add role assignments (official documentation)

url: _spPageContextInfo.siteServerRelativeUrl + "/_api/web/lists/GetByTitle('" + listTitle + "')/getitembyid(" + id + ")/roleassignments/addroleassignment(principalid=<user or group id>, roledefid=1073741827)"

    // roledefid for Permission Levels are as follows:
    // 1073741829, Full Control
    // 1073741827, Contribute
    // 1073741826, Read

The documentation shows you can perform addroleassignment to a web object, but again, provide your list item instead.

For the second request, I needed to add this to the headers:

"X-RequestDigest": jQuery("#__REQUESTDIGEST").val()