Get user permissions using CSOM

Question

For SharePoint Online, I am trying to get user permissions on a site, including library, folders and files, using CSOM.

I have the following code:

 ClientResult<BasePermissions> info = site.Web.GetUserEffectivePermissions(user.LoginName);

and well I have two problems, first, info is null.

Second, I cannot use info.RoleAssignments Visual Studio gives me the error:

Error 1 'Microsoft.SharePoint.Client.ClientResult' does not contain a definition for 'RoleAssignments' and no extension method 'RoleAssignments' accepting a first argument of type 'Microsoft.SharePoint.Client.ClientResult' could be found (are you missing a using directive or an assembly reference?)

I read that when you are using SharePoint dll you may have used the wrong one, but I am using SharePoint.Client so, any ideas?

This is the first part of the code:

 using (ClientContext site = new ClientContext(siteTextBox.Text))
 {
     SecureString password = new SecureString();
     foreach (char c in "mypass".ToCharArray()) passWord.AppendChar(c);
     site.Credentials = new SharePointOnlineCredentials("[email protected]", password);
     site.Load(site.Web);
     site.ExecuteQuery();
     Web web = site.Web;    
     User user = web.EnsureUser(userTextBox.Text); //string is like: [email protected] on userTextBox
     site.Load(user);
     site.ExecuteQuery();

     ClientResult<BasePermissions> info = site.Web.GetUserEffectivePermissions(user.LoginName);

     //info.RoleAssignments is not recognized
     foreach (SPRoleAssignment roleAssignment in info.RoleAssignments)
     {
          //Do something
     }

}

Answer 1

RoleAssignment and BasePermissions are two different things.

RoleAssignment specifies a binding between:

• Principal (User or Group),
• SecurableObject (an object you can assign permissions to, like Web, List, ListItem),
• Collection of RoleDefinition bindings (or permission levels. Each RoleDefinition is a set of specific rights - BasePermissions).

BasePermission object (result of GetUserEffectivePermissions method), represents the actual rights user has on particular SecurableObject (web in your example). Those rights are sum of all permissions assigned to user directly, through group membership or inherited from parent objects.

There is no API to iterate RoleAssignments or permissions of specific user. You need to iterate all the objects. This may be a starting point:

using (ClientContext context = new ClientContext("https://contoso.com"))
{
    //no need to load web
    var web = context.Web;
    var user = web.EnsureUser(userLogin);
    context.Load(user, u => u.LoginName);

    var lists = web.Lists;
    context.Load(lists, lc => lc.Include(l => l.Title));
    //you can use one execute per multiple loads
    context.ExecuteQuery();

    foreach (var list in lists)
    {
        var permissions = list.GetUserEffectivePermissions(user.LoginName);
        var assignments = list.RoleAssignments;
        context.Load(assignments, ac => ac.Include(
            a => a.RoleDefinitionBindings, a => a.Member.LoginName));
        context.ExecuteQuery();

        //check edit rights on the object
        var canEdit = permissions.Value.Has(PermissionKind.EditListItems);
        if (canEdit)
        {
            Console.WriteLine("User has edit rights to: {0}", list.Title);
        }

        //get role assignments
        var assignment = assignments.FirstOrDefault(a => a.Member.LoginName == user.LoginName);

        if (assignment != null)
        {
            foreach (var role in assignment.RoleDefinitionBindings)
            {
                Console.WriteLine("  Role: {0}", role.Name);
            }
        }
    }
}

Answer 2

To solve your first question:

and well I have two problems, first, info is null.

After:

ClientResult<BasePermissions> info = site.Web.GetUserEffectivePermissions(user.LoginName);

add this line:

site.ExecuteQuery();

You will see that info is not null and also you will get access to

BasePermissions bp = info.Value;

Related to your second question:

there's no simple way to ask for user permissions details on the site?

the answer is that in Microsoft 365 SharePoint apparently it is not possible without Microsoft Graph API to get the list of users in the Owners, Members and Visitors groups of the site.

See this discussion:

Get users within o365 Group using CSOM