3

I've discovered that calling context.ExecuteQuery() is very slow and expensive if what you're trying to do is determine whether the current user (impersonated via Kerberos) even has permissions to access a given site. The code snippet looks roughly like this:

            var rootWeb = context.Site.RootWeb;
            BasePermissions bp = new BasePermissions();
            bp.Set(PermissionKind.Open);

            ClientResult<bool> viewListItems = context.Web.DoesUserHavePermissions(bp);

            try
            {                
                 context.ExecuteQuery();
                 // ...
            }
            catch(Exception ex)
            {
                Console.WriteLine("\n ---> You don't have access to site {0}\n   -- Exception: {1}", webUri, ex.Message);
            }

In actual fact, if the user doesn't have access to the site, the query triggers an endless loop of redirects which the system stops at 50, and that's what trips the exception. But it's very time-consuming, not to mention inelegant.

What I'd like to do, of course, is test the user's permissions to access the site. Does anyone here know how I can do this?

Thanks in advance
Josh

3
  • we are missing come code here. how are you init-ing your context object? also, what is the ctx? This looks like it may have been cut and paste without checking your objects for consistency. Are both ctx and context pointing to your client context? – ghangas Dec 15 '15 at 21:13
  • Yes they are. The code was edited for brevity, and is here just so readers get a rough idea of what I'm seeing. You weren't meant to critique the code or anything like that – Josh Korn Dec 16 '15 at 2:26
  • I meant no offense, but in this case the typos were relevant to the question. – ghangas Dec 16 '15 at 17:40
2
           //Use below commented line if want to connect through some user ID and password Instead of windows authentication
           //context.Credentials = new NetworkCredential("userId", "password", "domain");
           Web rootWeb = context.Site.RootWeb;
            context.Load(rootWeb);

            BasePermissions bp = new BasePermissions();
            bp.Set(PermissionKind.ManageWeb);
            //
            ClientResult<bool> viewListItems = rootWeb.DoesUserHavePermissions(bp);
            try
            {                
                    context.ExecuteQuery();
                    if(viewListItems.Value){
                        Console.WriteLine(" ---> You have access to site {0}", webUri);
                    }
                    else{
                            Console.WriteLine(" ---> You don't have access to site {0}", webUri); 
                    }

            }
            catch(Exception ex)
            {
                Console.WriteLine("\n ---> You don't have access to site {0}\n   -- Exception: {1}", webUri, ex.Message);
            }

This code works fine, tried for user with access and without access, it takes same time.

Here I have used bp.Set(PermissionKind.ManageWeb); to verify if user have permission on the web. its your choice which all permissions you want to verify

refer MSDNfor more permissions available to check

3
  • Gaurravs, I tried that, and it seemed to work more or less the same way as the code I originally had. I wonder if you were removing access the same way I was -- by disabling Anonymous Authentication in IIS. There's a reason I need to test this - it's required for Kerberos delegation, or so I've been led to believe. Would you be able to give your solution a quick spin with Anonymous Authentication disabled, just to see if you get roughly the same exception as I do? Thanks in advance, Josh. – Josh Korn Dec 16 '15 at 21:23
  • Anonymous Authentication is disabled by default at my end. and code works fine. To give more clarity, I am running this code from different domain, while site is hosted under different domain. I have updated my code using which I am connecting to the site – Gaurravs Dec 17 '15 at 6:32
  • refer the commented line at top of code – Gaurravs Dec 17 '15 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.