Is it possible to determine if a user can access a given item identified by its url without the users context - it has to be done with CSOM.

Code so far:

var file = web.GetFileByServerRelativeUrl(relative);
clientContext.Load(file, f => f.ListItemAllFields);

var listitem = file.ListItemAllFields;
clientContext.Load(listitem, f => f.RoleAssignments.Include(r => r.RoleDefinitionBindings, r => r.Member), f => f.RoleAssignments.GetByPrincipal(user)); // <= this line breaks it

RoleAssignmentCollection roleAssignments = listitem.RoleAssignments;

Or with another call:

bool hasPermissions = false;
var roleAssignment = roleAssignments.GetByPrincipal(user); // <= breaks

foreach (RoleDefinition role in roleAssignment.RoleDefinitionBindings)
    hasPermissions = role.BasePermissions.Has(PermissionKind.Open);

    if (hasPermissions) break;

I tried many combinations but every time I use GetByPrincipal I get an exception. Any pointers?

  • 1
    I assume you can only see the item permissions in an elevated context (this excludes CSOM)- a confirmation would be great. Nov 22, 2013 at 21:46
  • couldn't you use the credentials of an admin account for this action or is this not an option? clientContext.Credentials = new NetworkCredential("user", "password", "domain"); May 20, 2015 at 12:03
  • you also could use permissionMask = new BasePermissions(); permissionMask.Set(PermissionKind.Open); listitem.DoesUserHavePermissions(permissionMask);
    – ReTech
    May 17, 2017 at 5:31
  • Max, both Dolgsthrasir and ReTech are correct. It looks like the account that you are executing the code might not have the proper permission in this case. If you post the text of the exception here, we can confirm that. Your options are as already advised, to elevate your credentials or ensure that your ID already has access. Dec 11, 2018 at 21:50


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.