1

I want to use a workflow to remove permissions on a calendar event/list item (with a category RPL) for all groups except group 'B' when the calendar event is created. Here is what i have so far but it blew up when i added the role assignment....looking for reccomendations.

private void onWorkflowActivated1_Invoked(object sender, ExternalDataEventArgs e)
    {
        string url = workflowProperties.WebUrl;
        SPSite site = new SPSite(url);
        SPWeb rootWeb = site.RootWeb;
        SPListItem li = workflowProperties.Item;

        SPRoleDefinitionCollection assignedRole = rootWeb.RoleDefinitions;            

        if (li["Category"].ToString().Equals("RPL"))
        {
            if (!li.HasUniqueRoleAssignments)
            {
                li.BreakRoleInheritance(false, true);
            }

            foreach (SPGroup g in rootWeb.Groups)
            {
                if (!g.Name.Equals("B"))
                {
                    SPRoleAssignment roleAssignment = new SPRoleAssignment(g);

                    roleAssignment.RoleDefinitionBindings.RemoveAll();

                    li.RoleAssignments.Add(roleAssignment);
                    li.Update();
                }
            }
        }
    }
3
  • See this post. It describes how to add the unique permissions correctly.
    – Alexander
    Apr 7, 2012 at 15:55
  • Are you trying to give it a different Role (ex: Read vs Contribute)?
    – Kit Menke
    Apr 9, 2012 at 14:45
  • Didn't think about it but when i break inheritance only the item creator has permission on the item. So all i needed to do was assign my custom role definition to the group in question and all was good.
    – MikeC
    Apr 9, 2012 at 16:53

2 Answers 2

2

I have a helper function that lets me give a role to particular item. The trick is to check if the SPPrincipal already has a role, and remove that role if it does.

if (exists)
{
    // the group should only have the role that was specified
    // if we don't remove them all, it will do an "append"
    // ex: if it has Read and we are adding Contribute, will have
    // Read AND Contribute
    roleAssignment.RoleDefinitionBindings.RemoveAll();
}

SPRoleDefinition roleDefinition = web.RoleDefinitions[roleDefinitionName];
roleAssignment.RoleDefinitionBindings.Add(roleDefinition);

The other thing to consider is that a workflow always runs as the current user.

  • If you are removing the permissions of the current user, it is very likely that you will run into issues.
  • If you are adding permissions, then you are probably OK

For example: I was making a workflow that updated a status field and then removed permissions to limit permissions to only an "admin" group. In the workflow, it would remove the permissions fine but then always fail... no matter what order my actions were in. It seems like it was doing a SPListItem.Update internally at the very end (which would always fail because the current user no longer had permission).

I eventually worked around this by always making an "Update with elevated privileges" action.

Also note, you can't run the workflow as the system account (after SP1). However, inside of a Workflow Action you can run with elevated privileges.

2
  • Can't you run a workflow with elevated permissions?
    – Christophe
    Apr 9, 2012 at 15:50
  • Not really.. check out my updated answer.
    – Kit Menke
    Apr 9, 2012 at 20:26
1

My two cents: using a workflow to restrict permissions when an item is created is usually a bad idea. Why? Because permissions are only applied after the item is created. Anybody who subscribes to alerts will be able to see the created item, before the workflow kicks in to restrict access.

3
  • I see your point.....this is a customer request (automate setting the permission on the calendar event)...i would be interested to know if there were a different way to automate that would restrict permission and alert....
    – MikeC
    Apr 9, 2012 at 16:48
  • I've come across this issue a couple times and I don't have a miracle solution. The only way I can think of - but I haven't tried - is to 1/create a dummy item 2/Change permissions and 3/update the item with the actual data.
    – Christophe
    Apr 9, 2012 at 16:56
  • Probably an event receiver attached to the list would be the best option if you want to modify the item before it is actually created.
    – Kit Menke
    Apr 11, 2012 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.