I've a site which uses some custom roledefinitions for assigning rights to users. I have implemented a method which checks if a certain user is assigned to a specific role, this method is as follows:

public bool IsUserInRole(SPUser user, SPWeb web, string roleName)
  SPRoleAssignment roleAssignment = web.RoleAssignments.GetAssignmentByPrincipal(user);
  SPRoleDefinition roleDefinition = web.RoleDefinitions[roleName];

  return roleAssignment.RoleDefinitionBindings.Contains(roleDefinition);

Now this works, but it doesn't take groups into account. For instance, if I place the user in a group which has contribute rights on a site, this function still returns false when I check for contribute rights.

I couldn't find the API call to perform the check the way SharePoint does it. Who knows if this call exists and if not: what would be a good way to mimic it? I could ofcourse get all the groups the user is enrolled in, get the assigned roles for those groups and check if the specified role exists in those collections; but that sounds a bit ugly and less performant.

To add some more info: SPUser.Groups only get's the SharePoint defined groups, so when you want to use this in combination with AD groups, even iterating the Groups property won't do.

  • Wow, I've been looking for a code snippet like this in forever. Great work, thank you so much!
    – user5779
    Commented Nov 24, 2011 at 16:01

1 Answer 1


Check this out:

public static bool IsUserInRole(SPUser user, SPWeb web, string roleName)
            SPPermissionInfo info = web.GetUserEffectivePermissionInfo(user.LoginName);
            SPRoleDefinition roleDefinition = web.RoleDefinitions[roleName];

            foreach (SPRoleAssignment roleAssignment in info.RoleAssignments)
                if (roleAssignment.RoleDefinitionBindings.Contains(roleDefinition))
                    return true;

            return false;
  • Should this work? It doesn't seem to work for me.
    – Jasper
    Commented Oct 19, 2011 at 13:51
  • I already tested it.You get any error? Commented Oct 19, 2011 at 14:04
  • Yeah, when I'm logged in as an FBA user and I try to do this call, I get an error page instantly. Doesn't matter if I run it elevated or not, access is being denied. It does work when I'm logged in as a site admin, but then it doesn't seem to return the rights inherited by the domain group.
    – Jasper
    Commented Oct 19, 2011 at 14:39
  • 1
    Sorry my bad. I was using the SPContext.Current.Web object for checking, and since that is initialized as the current user, there were insufficient permissions to enumerate the rights. Getting the corrent site/web inside the RunWithElevatedPrivileges fixed this. Works great, thanks!
    – Jasper
    Commented Oct 19, 2011 at 15:12
  • I updated the code to handle the case when a user is assigned to many groups. Please note. Commented Oct 21, 2011 at 5:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.