3

For SharePoint Online, I am trying to get user permissions on a site, including library, folders and files, using CSOM.

I have the following code:

 ClientResult<BasePermissions> info = site.Web.GetUserEffectivePermissions(user.LoginName);

and well I have two problems, first, info is null.

Second, I cannot use info.RoleAssignments Visual Studio gives me the error:

Error 1 'Microsoft.SharePoint.Client.ClientResult' does not contain a definition for 'RoleAssignments' and no extension method 'RoleAssignments' accepting a first argument of type 'Microsoft.SharePoint.Client.ClientResult' could be found (are you missing a using directive or an assembly reference?)

I read that when you are using SharePoint dll you may have used the wrong one, but I am using SharePoint.Client so, any ideas?

This is the first part of the code:

 using (ClientContext site = new ClientContext(siteTextBox.Text))
 {
     SecureString password = new SecureString();
     foreach (char c in "mypass".ToCharArray()) passWord.AppendChar(c);
     site.Credentials = new SharePointOnlineCredentials("admin@tenant.com", password);
     site.Load(site.Web);
     site.ExecuteQuery();
     Web web = site.Web;    
     User user = web.EnsureUser(userTextBox.Text); //string is like: name@tenant.com on userTextBox
     site.Load(user);
     site.ExecuteQuery();

     ClientResult<BasePermissions> info = site.Web.GetUserEffectivePermissions(user.LoginName);

     //info.RoleAssignments is not recognized
     foreach (SPRoleAssignment roleAssignment in info.RoleAssignments)
     {
          //Do something
     }

}
3
  • 1
    could you add complete code? Does user.LoginName contains any value. This might help
    – nbi
    Feb 6, 2016 at 14:50
  • Hi @nbi, I already checked that, login name is in the format mentioned on that link, what other code you think could be useful?
    – ana
    Feb 8, 2016 at 3:48
  • If possible could you add more code?
    – nbi
    Feb 8, 2016 at 5:42

2 Answers 2

9

RoleAssignment and BasePermissions are two different things.

RoleAssignment specifies a binding between:

  • Principal (User or Group),
  • SecurableObject (an object you can assign permissions to, like Web, List, ListItem),
  • Collection of RoleDefinition bindings (or permission levels. Each RoleDefinition is a set of specific rights - BasePermissions).

BasePermission object (result of GetUserEffectivePermissions method), represents the actual rights user has on particular SecurableObject (web in your example). Those rights are sum of all permissions assigned to user directly, through group membership or inherited from parent objects.

There is no API to iterate RoleAssignments or permissions of specific user. You need to iterate all the objects. This may be a starting point:

using (ClientContext context = new ClientContext("https://contoso.com"))
{
    //no need to load web
    var web = context.Web;
    var user = web.EnsureUser(userLogin);
    context.Load(user, u => u.LoginName);

    var lists = web.Lists;
    context.Load(lists, lc => lc.Include(l => l.Title));
    //you can use one execute per multiple loads
    context.ExecuteQuery();

    foreach (var list in lists)
    {
        var permissions = list.GetUserEffectivePermissions(user.LoginName);
        var assignments = list.RoleAssignments;
        context.Load(assignments, ac => ac.Include(
            a => a.RoleDefinitionBindings, a => a.Member.LoginName));
        context.ExecuteQuery();

        //check edit rights on the object
        var canEdit = permissions.Value.Has(PermissionKind.EditListItems);
        if (canEdit)
        {
            Console.WriteLine("User has edit rights to: {0}", list.Title);
        }

        //get role assignments
        var assignment = assignments.FirstOrDefault(a => a.Member.LoginName == user.LoginName);

        if (assignment != null)
        {
            foreach (var role in assignment.RoleDefinitionBindings)
            {
                Console.WriteLine("  Role: {0}", role.Name);
            }
        }
    }
}
1
  • Thanks for your answer, but then there's no simple way to ask for user permissions details on the site?
    – ana
    Feb 22, 2016 at 21:40
0

To solve your first question:

and well I have two problems, first, info is null.

After:

ClientResult<BasePermissions> info = site.Web.GetUserEffectivePermissions(user.LoginName);

add this line:

site.ExecuteQuery();

You will see that info is not null and also you will get access to

BasePermissions bp = info.Value;

Related to your second question:

there's no simple way to ask for user permissions details on the site?

the answer is that in Microsoft 365 SharePoint apparently it is not possible without Microsoft Graph API to get the list of users in the Owners, Members and Visitors groups of the site.

See this discussion:

Get users within o365 Group using CSOM

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.