4

I'm facing a site collection where both role assignment ("permissions") inheritance and role definition ("permission levels") inheritance has been broken.

The role assignment inheritance can be broken with SPWeb.BreakRoleInheritance. The role definition inheritance can be broken with SPRoleDefinitionCollection.BreakInheritance (via SPWeb.RoleDefinitions.BreakInheritance).

Inherited role assignments AND role definitions can be restored with SPWeb.ResetRoleInheritance (i.e. all unique assignments and definitions are discarded - this is actually what happens when you click "Inherit Permission Levels from Parent Web Site" link under Permission Levels).

How do I restore just the inherited role definition behaviour and keep the unique role assigments?

Improve this question

2 Answers 2

Reset to default
3

Reseting role definitions could possibly lead to an inconsistency if new definitions have been added and used in assignments.
That's why, I presume, you canno't revert définitions without also reverting assignments. I checked in the SharePoint OM assemblies, and even internally there's no method to revert defintions only...

Improve this answer
5
  • It is not conceptually impossible - unique roles from sub webs would have to be added to the web the definitions are inherited from.. much like the methods I mention for breaking (they contain parameters to copy information)
    – mhbuur
    Commented Dec 16, 2015 at 10:16
  • That would imply you have permissions to edit (add) role def at the parent level... we can't assume (and conceptually can't allow) an action on the child has write-effects on the parent...
    – Evariste
    Commented Dec 16, 2015 at 10:34
  • Question is if this is not handled already if you try to do something you're not allowed to? Anyways I wonder how that point scales to SPWeb.ResetRoleInheritance which according to documentation resets all child webs (which could have unique permissions, e.g. meaning that "you" wouldn't have access to the given web in the first place).
    – mhbuur
    Commented Dec 16, 2015 at 10:46
  • 1
    Actually, the documentation is probably not accurate on this, but reseting assignments on sub-site A won't reset assignments on sub-sites of sub-site A. If sub-site A has unique assignments, and sub-site B (child of A) also has unique permissions, reseting on A won't have any effect on B. This is "logical" and also I've just tested to confirm this result.
    – Evariste
    Commented Dec 16, 2015 at 11:08
  • Seems you're right about that! The documentation is quite off there: "All descendant objects of the website on which this method is run will also now inherit from this website's parent, not just the immediate children.". Anyway, I still believe the opposite move makes sense, provided that you have the rights to carry out the operation..
    – mhbuur
    Commented Dec 16, 2015 at 13:51
3

It is tricky, and I think there is no straight forward way to retain the unique permissions when you roll back to inherit parent's permissions.

If you read and compare the definitions of SPWeb.BreakRoleInheritance and SPWeb.ResetRoleInheritance

You will notice that SPWeb.ResetRoleInheritance has no parameters to pass where we can instruct SharePoint to retain something. On the other hand the SPWeb.BreakRoleInheritance consists of a parameter bool copyRoleAssignments where we instruct SharePoint to copy the existing role assignments along with unique breaking the inheritance.

So the functionality which you seek is not there in OOB methods, but its vice versa is available.

Improve this answer
1
  • yes, that is what I conclude in the question too. So how do I get around that?
    – mhbuur
    Commented Dec 16, 2015 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.