Programmatically create SharePoint security groups using configuration
Corey Roth has a great article “A simple way to programmatically create SharePoint security groups“. On a recent project I needed to configure security during feature activation for security restricted WebParts (the WebParts checked the current user was a member of a particular security group) but didn’t want to hardcode the values. The article used a XML configuration to define which groups needed creating and the membership.
SharePoint supports setting the owner of a SharePoint group to be an individual user or another security group, I extended the code to support this and to set the flags which control members editing membership, request to join or leave and auto accept request to join or leave. Here’s the updated version of CreateGroups.
private void CreateGroups(SPWeb currentSite, string groupsConfigBody)
{
{
// get the xml document from the feature folder
XDocument groupsXml = XDocument.Parse(groupsConfigBody);
XDocument groupsXml = XDocument.Parse(groupsConfigBody);
// create a new anoynmous type with the group data
var groups = from sharePointGroup in groupsXml.Root.Elements(“Group”)
select new
{
var groups = from sharePointGroup in groupsXml.Root.Elements(“Group”)
select new
{
Name = sharePointGroup.Attribute(“Name”).Value,
Owner = sharePointGroup.Attributes(“Owner”).Any() ? sharePointGroup.Attribute(“Owner”).Value : null,
Description = sharePointGroup.Attributes(“Description”).Any() ? sharePointGroup.Attribute(“Description”).Value : string.Empty,
PermissionLevel = sharePointGroup.Attributes(“PermissionLevel”).Any() ? sharePointGroup.Attribute(“PermissionLevel”).Value : null,
Users = sharePointGroup.Elements(“User”).Any() ? sharePointGroup.Elements(“User”) : null,
AllowMembersEditMembership = sharePointGroup.Attributes(“AllowMembersEditMembership”).Any() ? Convert.ToBoolean(sharePointGroup.Attribute(“AllowMembersEditMembership”).Value) : false,
AllowRequestToJoinLeave = sharePointGroup.Attributes(“AllowRequestToJoinLeave”).Any() ? Convert.ToBoolean(sharePointGroup.Attribute(“AllowRequestToJoinLeave”).Value) : false,
AutoAcceptRequestToJoinLeave = sharePointGroup.Attributes(“AutoAcceptRequestToJoinLeave”).Any() ? Convert.ToBoolean(sharePointGroup.Attribute(“AutoAcceptRequestToJoinLeave”).Value) : false
};
Owner = sharePointGroup.Attributes(“Owner”).Any() ? sharePointGroup.Attribute(“Owner”).Value : null,
Description = sharePointGroup.Attributes(“Description”).Any() ? sharePointGroup.Attribute(“Description”).Value : string.Empty,
PermissionLevel = sharePointGroup.Attributes(“PermissionLevel”).Any() ? sharePointGroup.Attribute(“PermissionLevel”).Value : null,
Users = sharePointGroup.Elements(“User”).Any() ? sharePointGroup.Elements(“User”) : null,
AllowMembersEditMembership = sharePointGroup.Attributes(“AllowMembersEditMembership”).Any() ? Convert.ToBoolean(sharePointGroup.Attribute(“AllowMembersEditMembership”).Value) : false,
AllowRequestToJoinLeave = sharePointGroup.Attributes(“AllowRequestToJoinLeave”).Any() ? Convert.ToBoolean(sharePointGroup.Attribute(“AllowRequestToJoinLeave”).Value) : false,
AutoAcceptRequestToJoinLeave = sharePointGroup.Attributes(“AutoAcceptRequestToJoinLeave”).Any() ? Convert.ToBoolean(sharePointGroup.Attribute(“AutoAcceptRequestToJoinLeave”).Value) : false
};
// iterate through the groups and create the groups
foreach (var sharePointGroup in groups)
{
// only create the group if it does not exist
if (!ContainsGroup(currentSite.SiteGroups, sharePointGroup.Name))
{
// add the owner to the web site users
if (sharePointGroup.Owner.IndexOf(@”\”) > -1)
{
SPUser owner = currentSite.EnsureUser(sharePointGroup.Owner);
currentSite.SiteGroups.Add(sharePointGroup.Name, owner, owner, sharePointGroup.Description);
}
else
{
SPMember owner = currentSite.SiteGroups[sharePointGroup.Owner];
currentSite.SiteGroups.Add(sharePointGroup.Name, owner, currentSite.CurrentUser, sharePointGroup.Description);
}
foreach (var sharePointGroup in groups)
{
// only create the group if it does not exist
if (!ContainsGroup(currentSite.SiteGroups, sharePointGroup.Name))
{
// add the owner to the web site users
if (sharePointGroup.Owner.IndexOf(@”\”) > -1)
{
SPUser owner = currentSite.EnsureUser(sharePointGroup.Owner);
currentSite.SiteGroups.Add(sharePointGroup.Name, owner, owner, sharePointGroup.Description);
}
else
{
SPMember owner = currentSite.SiteGroups[sharePointGroup.Owner];
currentSite.SiteGroups.Add(sharePointGroup.Name, owner, currentSite.CurrentUser, sharePointGroup.Description);
}
SetRoleDefinitionBinding(sharePointGroup.Name, currentSite, sharePointGroup.PermissionLevel);
if (sharePointGroup.AllowMembersEditMembership || sharePointGroup.AllowRequestToJoinLeave || sharePointGroup.AutoAcceptRequestToJoinLeave)
{
SPGroup group = currentSite.SiteGroups[sharePointGroup.Name];
if (sharePointGroup.AllowMembersEditMembership)
group.AllowMembersEditMembership = true;
{
SPGroup group = currentSite.SiteGroups[sharePointGroup.Name];
if (sharePointGroup.AllowMembersEditMembership)
group.AllowMembersEditMembership = true;
if (sharePointGroup.AllowRequestToJoinLeave)
group.AllowRequestToJoinLeave = true;
group.AllowRequestToJoinLeave = true;
if (sharePointGroup.AutoAcceptRequestToJoinLeave)
group.AutoAcceptRequestToJoinLeave = true;
group.AutoAcceptRequestToJoinLeave = true;
group.Update();
}
}
}
}
// add the users to the group
AddUsersToGroup(sharePointGroup.Name, sharePointGroup.Users, currentSite);
AddUsersToGroup(sharePointGroup.Name, sharePointGroup.Users, currentSite);
}
}
and the XML configuration
<?xml version=”1.0″ encoding=”utf-8″ ?>
<Groups>
<Group Name=”Admins” Owner=”domain\dave” AllowMembersEditMembership=”true” Description=”Set of admin users who control membership of the Bulk Processing group” PermissionLevel=”Read”>
<User Name=”domain\dave” />
</Group>
<Group Name=”My Security Group” Owner=”Admins” Description=”description goes here” PermissionLevel=”Read”>
<User Name=”domain\dave” />
</Group>
</Groups>
<Groups>
<Group Name=”Admins” Owner=”domain\dave” AllowMembersEditMembership=”true” Description=”Set of admin users who control membership of the Bulk Processing group” PermissionLevel=”Read”>
<User Name=”domain\dave” />
</Group>
<Group Name=”My Security Group” Owner=”Admins” Description=”description goes here” PermissionLevel=”Read”>
<User Name=”domain\dave” />
</Group>
</Groups>
Advertisement