0

I was searching for a method which returns SPUser object based on the display name of the user, and I found the EnsureUser() method. as I want to use this method inside my SharePoint server 2013 event receiver, as follow:-

public override void ItemAdded(SPItemEventProperties properties)
{

           base.ItemAdded(properties);

           SPUser spUser = properties.Site.RootWeb.EnsureUser(approver);//You can get SPUser from here

            currentItem["ProjectApprover"] = spUser;
            currentItem.SystemUpdate();

now based on MSDN documentation the method will not just return SPUser from a user display name but will also do the following:-

Checks whether the specified logon name belongs to a valid user of the website, and if the logon name does not already exist, adds it to the website.

so can anyone advice how EnsureUser() actually works? I have the following 4 points which I can not understand:-

  1. I thought that EnsureUser() will check if the user has any permission on the site, and if so it will return the related SPUser. but as the documentation mentioned that the method will add the user to the website if it can not validate it? so where the user will be added (under which group)?

  2. now let say I pass a test string to the EnsureUser() method as follow

SPUser spUser = properties.Site.RootWeb.EnsureUser("ONLY For Testing");//You can get SPUser from here

so, in this case, the method will not find any user named "ONLY For Testing", so will it add the "ONLY For Testing" user to the site?

  1. inside the official documentation it mentioned that the method will check "..whether the specified logon name belongs to a valid user of the website..", so what does belong exactly means?. let say we have a user named john.smith inside our active directory, and this user does not have any permission to access the properties.Site.RootWeb, so will this method:-

       SPUser spUser = properties.Site.RootWeb.EnsureUser("john.smith");//You can get SPUser from here
    

return that the user is valid ? or the user should have at least read permission on the properties.Site.RootWeb to be able to pass the EnsureUser() validation?

  1. now since I am using this method inside an event receiver.. so should the user who run the event receiver have any special permission to be able to run the EnsureUser method on the properties.Site.RootWeb?, I mean should he/she be able to access the properties.Site.RootWeb permission section (in other words to be a site admin??
3
  1. I thought that EnsureUser() will check if the user have any permission on the site, and if so it will return the realted SPUser. but as the documentation mentioned that the method will add the user to the website if it can not validate it? so where the user will be added (under which group)?

EnsureUser checks whether the specified login name belongs to a valid user of the Web site, and if the login name does not already exist, adds it to the Web site directly.You can check the User Information List where actually it adds the user.It does not also create a new account, but checks if the account has access to the site. If not and the user is valid, it adds the user to the site permission list of the specific website.

2.now let say i pass a test string to the EnsureUser() method as follow

No if you pass random string to ensureuser it wont work.It needs a specific input format like @"domain\username"

If you pass random string it will give you SPException of user not found.

3/4

AFAIK you have to explicitly assign permission to the newly created user.As ensureuser directly doesn't assign any role/permission.

SPUser newUser = newWeb.EnsureUser(@"domain\username");
newWeb.AllowUnsafeUpdates = true;
SPRoleAssignment roleAssignment = new SPRoleAssignment(newUser);
SPRoleDefinitionBindingCollection roleDefBindings = roleAssignment.RoleDefinitionBindings;
roleDefBindings.Add(roleDefinitions["Read"]);
roleAssignments.Add(roleAssignment);
  • thanks for the great reply. but i still have the following questions if you can answer please 1) when you say that EnsureUser() will check if the user belong to the site, but what does the word belong exactly mean? let say i added an Active directory group to the site Members Group, and this active directory group contain User.A & User.B.. then will properties.Site.RootWeb.EnsureUser(User.A) return that the user is valid or that the user is not valid ? in other word should the user be explicitly assigned to the web to pass the EnsureUser() check ? – john Gu May 28 '17 at 12:24
  • Question 2) as i said i am running the following code SPUser spUser = properties.Site.RootWeb.EnsureUser(approver); inside itemadding event receiver.. and the ER will be running under the current user permission.. so let say a contributor user named "Current.User" caused the ER to fire, and the EnsureUser("john smith") return that john.smith is a valid user,but does not belong to the site. So then EnsureUser will be adding the user ( john.smith) to the User Information List ,, – john Gu May 28 '17 at 12:32
  • so does this operation require the current.user which the ER is running under to be a site admin? in other word should i run the EnsureUser() method inside my ER under elevated privilege ? third question. 3). now in my case i do not need to pass the domain name inside the EnsureUser() method.. as if i only pass the display name as follow EnsureUser("john Smith") will be sufficient to return the SPUser() ... You mentioned i need to pass the domain name inside the EnsureUser(), but based on my test passing the display name wihtout the domain name will also work – john Gu May 28 '17 at 12:47
  • You asked too many different questions on a single thread.I would suggest to create another concise question focusing a specific point. – Navoneel Talukdar May 28 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.