Remove non full controlled Permission Sharepoint Groups from a SharePoint List using Client Object Model

Question

I have SharePoint List which has stopped inheriting from the Parent Sub Site. I need to retrieve the SharePoint Groups which are not been assigned with Full Control on the List. Then I need to remove them from the List Permissions only.

foreach (var assignment in oListitem.RoleAssignments)
{
    assignment.RoleDefinitionBindings.RemoveAll();
    assignment.Update();
}

The above code was able to remove all permissions, but I want to remove only Groups which do not have Full Control. Thanks.

Answer 1

It did take me quite some time to create a fully functional code as per your requirements but I must admit it was great learning :-)

ClientContext clientContext = new ClientContext("http://demo2010a:90");
            Web site = clientContext.Web;
            List list = clientContext.Web.Lists.GetByTitle("TestList");
            clientContext.Load(site, s => s.RoleDefinitions);
            clientContext.ExecuteQuery();
            clientContext.Load(list, l => l.HasUniqueRoleAssignments);
            clientContext.ExecuteQuery();
            List<Principal> groupsToRemove = new List<Principal>();            
            if (list.HasUniqueRoleAssignments)
            {
                RoleDefinition role = site.RoleDefinitions.GetByName("Full Control");
                clientContext.Load(role);
                clientContext.ExecuteQuery();
                RoleAssignmentCollection oRoleAssignments = list.RoleAssignments;
                clientContext.Load(oRoleAssignments);
                clientContext.ExecuteQuery();

                foreach (RoleAssignment oRoleAssignment in oRoleAssignments)
                {
                    clientContext.Load(oRoleAssignment, r => r.Member, r => r.RoleDefinitionBindings);
                    clientContext.ExecuteQuery();
                    Principal oPrincipal = oRoleAssignment.Member;
                    if (oPrincipal.PrincipalType == Microsoft.SharePoint.Client.Utilities.PrincipalType.SharePointGroup)
                    {
                        int roleDefCount = 0;
                    foreach (RoleDefinition def in oRoleAssignment.RoleDefinitionBindings)
                    {
                        if (def.Id == role.Id)
                        {                                
                            break;
                        }
                        else
                        {
                            roleDefCount++;
                            if (roleDefCount == oRoleAssignment.RoleDefinitionBindings.Count)
                                groupsToRemove.Add(oPrincipal);
                        }
                    }                     
                    }
                }

                foreach (Principal group in groupsToRemove)
                {
                    list.RoleAssignments.GetByPrincipal(group).DeleteObject();
                }

                list.Update();
            }

            clientContext.ExecuteQuery();
        }

EDIT

Corrected the bug in foreach (RoleDefinition def in oRoleAssignment.RoleDefinitionBindings) loop. I actually tried to use a simpler statement i.e.

 if (!oRoleAssignment.RoleDefinitionBindings.Contains(role))
 {
       groupsToRemove.Add(oPrincipal);
 }

But it gives follwoing error: Invalid usage of query execution. The query should be executed by using ExecuteQuery method on the client context object. Anyone having idea why this error comes up?

Answer 2

Hi This is my solution though looks like both of are almost same

string listTitle = "Invoices";
using (ClientContext Ctx = new ClientContext("URL"))
{
    Ctx.Credentials = new NetworkCredential("username", "password", "domain");
    Web oWeb = Ctx.Web;
    List oList;
    ListCollection oLists = oWeb.Lists;
    IEnumerable<List> existingLists = Ctx.LoadQuery(
        oLists.Where(L => L.Title == listTitle));
    Ctx.ExecuteQuery();
    oList = existingLists.FirstOrDefault();
    if (oList != null)
    {
        Ctx.Load(oList, l => l.HasUniqueRoleAssignments);
        Ctx.Load(oList, l => l.RoleAssignments);
        Ctx.ExecuteQuery();

        if (!oList.HasUniqueRoleAssignments)
        {
            oList.BreakRoleInheritance(true, true);
            oList.Update();
            Ctx.ExecuteQuery();

            foreach (var assignment in oList.RoleAssignments)
            {
                Ctx.Load(assignment.RoleDefinitionBindings);
                Ctx.Load(assignment.Member);
                Ctx.ExecuteQuery();

                int Cnt = assignment.RoleDefinitionBindings.Count;
                int RDCnt = 0;

                foreach (RoleDefinition rd in assignment.RoleDefinitionBindings)
                {
                    if (rd.RoleTypeKind != RoleType.Administrator)
                        RDCnt++;
                }

                if (Cnt == RDCnt)
                {
                    Principal Pri = assignment.Member;

                    if (Pri.PrincipalType == PrincipalType.SharePointGroup)
                    {
                        oList.RoleAssignments.GetByPrincipal(Pri).DeleteObject();
                        oList.Update();
                    }
                    Ctx.ExecuteQuery();
                }

            }
        }
    }
}

Definitely a good learning curve :)