Where will EnsureUser() method add users, and how it is going to validate users

Question

I was searching for a method which returns SPUser object based on the display name of the user, and I found the EnsureUser() method. as I want to use this method inside my SharePoint server 2013 event receiver, as follow:-

public override void ItemAdded(SPItemEventProperties properties)
{

           base.ItemAdded(properties);

           SPUser spUser = properties.Site.RootWeb.EnsureUser(approver);//You can get SPUser from here

            currentItem["ProjectApprover"] = spUser;
            currentItem.SystemUpdate();

now based on MSDN documentation the method will not just return SPUser from a user display name but will also do the following:-

Checks whether the specified logon name belongs to a valid user of the website, and if the logon name does not already exist, adds it to the website.

so can anyone advice how EnsureUser() actually works? I have the following 4 points which I can not understand:-

1. I thought that EnsureUser() will check if the user has any permission on the site, and if so it will return the related SPUser. but as the documentation mentioned that the method will add the user to the website if it can not validate it? so where the user will be added (under which group)?

2. now let say I pass a test string to the EnsureUser() method as follow

SPUser spUser = properties.Site.RootWeb.EnsureUser("ONLY For Testing");//You can get SPUser from here

so, in this case, the method will not find any user named "ONLY For Testing", so will it add the "ONLY For Testing" user to the site?

3. inside the official documentation it mentioned that the method will check "..whether the specified logon name belongs to a valid user of the website..", so what does belong exactly means?. let say we have a user named john.smith inside our active directory, and this user does not have any permission to access the properties.Site.RootWeb, so will this method:-

      SPUser spUser = properties.Site.RootWeb.EnsureUser("john.smith");//You can get SPUser from here
   

return that the user is valid ? or the user should have at least read permission on the properties.Site.RootWeb to be able to pass the EnsureUser() validation?

4. now since I am using this method inside an event receiver.. so should the user who run the event receiver have any special permission to be able to run the EnsureUser method on the properties.Site.RootWeb?, I mean should he/she be able to access the properties.Site.RootWeb permission section (in other words to be a site admin??

Answer 1

1. I thought that EnsureUser() will check if the user have any permission on the site, and if so it will return the realted SPUser. but as the documentation mentioned that the method will add the user to the website if it can not validate it? so where the user will be added (under which group)?

EnsureUser checks whether the specified login name belongs to a valid user of the Web site, and if the login name does not already exist, adds it to the Web site directly.You can check the User Information List where actually it adds the user.It does not also create a new account, but checks if the account has access to the site. If not and the user is valid, it adds the user to the site permission list of the specific website.

2.now let say i pass a test string to the EnsureUser() method as follow

No if you pass random string to ensureuser it wont work.It needs a specific input format like @"domain\username"

If you pass random string it will give you SPException of user not found.

3/4

AFAIK you have to explicitly assign permission to the newly created user.As ensureuser directly doesn't assign any role/permission.

SPUser newUser = newWeb.EnsureUser(@"domain\username");
newWeb.AllowUnsafeUpdates = true;
SPRoleAssignment roleAssignment = new SPRoleAssignment(newUser);
SPRoleDefinitionBindingCollection roleDefBindings = roleAssignment.RoleDefinitionBindings;
roleDefBindings.Add(roleDefinitions["Read"]);
roleAssignments.Add(roleAssignment);