In MOSS 2007, I used to use the following code to configure security permissions on a site (also created via code):

/*Line 1*/rootWeb.CreateDefaultAssociatedGroups("CONTOSO\\SiteAdmin", "", "");

// Add an admin domain security group to the Owners Group - FULL Access
SPGroup SPOwnersGroup = site.RootWeb.AssociatedOwnerGroup;
/*Line 2*/SPUser ownerUsersByGroup = site.RootWeb.EnsureUser("CONTOSO\\SiteOwnersAccessGroup");

// Add a contributor-level type domain security group the the Members Group - Contribute Access
SPGroup SPMembersGroup = site.RootWeb.AssociatedMemberGroup;
SPUser memberUsersByGroup = site.RootWeb.EnsureUser("CONTOSO\\SiteMembersAccessGroup");

The above code is not working, and I think it has something to do with claims. If I change the Line 1 to:

rootWeb.CreateDefaultAssociatedGroups("i:0#.w|CONTOSO\\SiteAdmin", "", "");

... the code moves on and fails at Line 2. CONTOSO\SiteOwnersAccessGroup is an AD security group. How do I go about adding specific users and AD security groups to the permissions groups of the site, without having to hard-code the claims format (which I am unfamiliar with)?

1 Answer 1


First, You can convert the loginname to calim using the below code

string userClaimsLoginName = "";
string userLoginNameWithDomain = @"mydomain\myuser";
string xmlTypeForString = "http://www.w3.org/2001/XMLSchema#string";

// This will depend on your own implementation
string originalIssuer = SPOriginalIssuers.Format(SPOriginalIssuerType.Windows);

SPClaimProviderManager mgr = SPClaimProviderManager.Local;
if (mgr != null)
    SPClaim claim = new SPClaim(SPClaimTypes.UserLogonName, userLoginNameWithDomain, xmlTypeForString, originalIssuer);
    userClaimsLoginName = mgr.EncodeClaim(claim);

the output


Ref: Convert SharePoint login name to claims format and back using C#

Second, the below code would help you to add AD groupto your site

SPRoleDefinitionCollection roleDefinitions = newWeb.RoleDefinitions;
SPRoleAssignmentCollection roleAssignments = newWeb.RoleAssignments;
SPUser newUser = newWeb.EnsureUser("AD group");
newWeb.AllowUnsafeUpdates = true;
SPRoleAssignment roleAssignment = new SPRoleAssignment(newUser);
SPRoleDefinitionBindingCollection roleDefBindings = roleAssignment.RoleDefinitionBindings;
newWeb.AllowUnsafeUpdates = false;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.