1

I have a situation where I am creating a "Secondary Admin" role within a custom project I am building. I need the second admin to be able to remove a user from a group without giving the permissions within the custom permissions level to do so. It will add the user just fine because I did give Manage Permissions control to this group, but when I try to remove, I get an access denied error.

All of the abilities for the users, including administrators, I am handling on the back end so users do not have to go into any SharePoint list or admin controls to perform these actions. Is there a way to get this done without giving the user higher permissions? I think I am just missing something here. Here is the code below:

SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using(SPSite spSite = new SPSite(siteUrl)) 
    {
        using(SPWeb spWeb = spSite.OpenWeb())
        {
            spWeb.AllowUnsafeUpdates = true;
            for (int i =0; i < userRequest.Length; i++)
            {                    
                SPGroup spGroup = spWeb.SiteGroups[userRequest.GetValue(i).ToString() + "_Contribute"];
                spGroup.AddUser(selectedUser);  //this works just fine

                try
                {
                    SPGroupCollection userCollection = selectedUser.Groups;
                    foreach(SPGroup group in userCollection)
                    {
                        if(group.Name == spWeb.SiteGroups[userRequest.GetValue(i) + "_Read"].ToString())
                        {
                            group.RemoveUser(selectedUser); //this is where I get Access Denied and a catch in my method if the user is not a Site Admin when the code is ran
                        }
                }
                catch 
                {
                    //the empty catch is just incase the user is not in the Read group and was only given Contribute originally
                }
            }
            spWeb.AllowUnsafeUpdates = false;
        }
    }
});

It of course works for Site Admins with the same logic. I have a reason for this in my project, and do not want to give any more privileges to the custom permissions group. I am trying to clean up permissions if a user is upgraded from Read to Contribute on a list that is not inherited from the parent. This is not a program killer, I just want to make sure all of the permissions are clean since I am doing all the work behind the scenes. Any help would be appreciated.

0

Set for SharePoint groups which you want to manage by this Second Admin:

  • Group Owner: Second Admin
  • Who can edit membership in group: Group Owner

Now this Account have Full Control permissions for this group.

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.