Use workflow to remove/add group permissions

Question

I want to use a workflow to remove permissions on a calendar event/list item (with a category RPL) for all groups except group 'B' when the calendar event is created. Here is what i have so far but it blew up when i added the role assignment....looking for reccomendations.

private void onWorkflowActivated1_Invoked(object sender, ExternalDataEventArgs e)
    {
        string url = workflowProperties.WebUrl;
        SPSite site = new SPSite(url);
        SPWeb rootWeb = site.RootWeb;
        SPListItem li = workflowProperties.Item;

        SPRoleDefinitionCollection assignedRole = rootWeb.RoleDefinitions;            

        if (li["Category"].ToString().Equals("RPL"))
        {
            if (!li.HasUniqueRoleAssignments)
            {
                li.BreakRoleInheritance(false, true);
            }

            foreach (SPGroup g in rootWeb.Groups)
            {
                if (!g.Name.Equals("B"))
                {
                    SPRoleAssignment roleAssignment = new SPRoleAssignment(g);

                    roleAssignment.RoleDefinitionBindings.RemoveAll();

                    li.RoleAssignments.Add(roleAssignment);
                    li.Update();
                }
            }
        }
    }

Answer 1

I have a helper function that lets me give a role to particular item. The trick is to check if the SPPrincipal already has a role, and remove that role if it does.

if (exists)
{
    // the group should only have the role that was specified
    // if we don't remove them all, it will do an "append"
    // ex: if it has Read and we are adding Contribute, will have
    // Read AND Contribute
    roleAssignment.RoleDefinitionBindings.RemoveAll();
}

SPRoleDefinition roleDefinition = web.RoleDefinitions[roleDefinitionName];
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);

The other thing to consider is that a workflow always runs as the current user.

• If you are removing the permissions of the current user, it is very likely that you will run into issues.
• If you are adding permissions, then you are probably OK

For example: I was making a workflow that updated a status field and then removed permissions to limit permissions to only an "admin" group. In the workflow, it would remove the permissions fine but then always fail... no matter what order my actions were in. It seems like it was doing a SPListItem.Update internally at the very end (which would always fail because the current user no longer had permission).

I eventually worked around this by always making an "Update with elevated privileges" action.

Also note, you can't run the workflow as the system account (after SP1). However, inside of a Workflow Action you can run with elevated privileges.

Answer 2

My two cents: using a workflow to restrict permissions when an item is created is usually a bad idea. Why? Because permissions are only applied after the item is created. Anybody who subscribes to alerts will be able to see the created item, before the workflow kicks in to restrict access.