Browser Forms

Re: Permissions/Access restrictions based on users and groups

GillRulez — Tue, 21 Jul 2009 19:52:15 GMT

If you add a data conection to GetUserCollectionFromGroup method, it does not recognize the correct result set and shows groupname as query and result. I edited those data connection xsd files to give it a result defination and used that. It gives me the list of all users from a group. I've attached a screenshot of data structure.

Re: Permissions/Access restrictions based on users and groups

warrtalon — Tue, 21 Jul 2009 18:43:45 GMT

By editing the XSD files?

Re: Permissions/Access restrictions based on users and groups

GillRulez — Tue, 21 Jul 2009 18:39:58 GMT

I actually got the GetUserCollectionFromGroup method from UserGroup webservice to work by editting the xsd files for the connection. Hopefully that'll make my life easier !!

Re: Permissions/Access restrictions based on users and groups

GillRulez — Mon, 20 Jul 2009 21:57:36 GMT

I believe if thats the case, I can get it enabled provided I have an article or some info backing me up. I'll be really thankful if you can find something.

Thanks again!

Re: Permissions/Access restrictions based on users and groups

warrtalon — Mon, 20 Jul 2009 21:14:40 GMT

I didn't say it's not related - it IS related, but it is not related to the ABILITY to create MySites, and it does not require MySites to BE enabled. I will try to find you some documentation on it. It's obvious that without the Personal Site permission, people can't create MySites, so the ability to interact with personal features without a MySite should not scare them (not sure why it does or what made them think that). it allows the use of colleagues, which is something that shows up on Mysites by default, but they won't have a MySite, so it doesn't matter. They can use the other features that come with it that are related to profile information.

Re: Permissions/Access restrictions based on users and groups

GillRulez — Mon, 20 Jul 2009 20:37:45 GMT

Hey...I'm back

So i had a discussion with my co-worker and if the personal features is not related to my sites, we can get it activated. Could you be able to send me a link for some blog or article preferably MS where they highlight this so I can forward it to them and have the feature enabled. I've been looking for it but could find anything specific.

Thanks for all the help!

Re: Permissions/Access restrictions based on users and groups

lanijade — Sun, 19 Jul 2009 04:47:50 GMT

Thanks for your help. Are you sick of me yet?

Yeah - I did a search online too and couldn't find anything. I also tried creating new groups (both DL and SG) in Active Directory and running the profile import again. Both DLs and SGs get this same message and don't appear in my INfoPath form when using the web service.

It is very strange.... I will have a chat with my colleague about this and see what we come up with. I'll post back here if / when we find the solution.

Thanks again.

Re: Permissions/Access restrictions based on users and groups

warrtalon — Sun, 19 Jul 2009 04:41:42 GMT

Wow, that's a new one. I can only find one instance of that error online that has to do with SharePoint, and no one answered it. That sounds like it's definitely why you aren't seeing SGs, but it's interesting that the SGs still work in SP. I guess when adding permissions, SP doesn't leverage the profile database, but rather goes straight to AD.

Try making a new DL and run your import - see if it comes through. Then, change it to an SG and run the import again. See if it works or if that exact one gets the same error.

Re: Permissions/Access restrictions based on users and groups

lanijade — Sun, 19 Jul 2009 04:27:45 GMT

Yep, I'm also seeing SharePoint site memberships iin the long repeating table.

Just went in and looked at the profile import logs. All DL imports have this next to them "The directory property cannot be found in the cache". I'm guessing this is causing the problems. Any suggestions?

Re: Permissions/Access restrictions based on users and groups

warrtalon — Sun, 19 Jul 2009 03:57:59 GMT

So, the only thing you get is one record, and it's that old DL? You don't also get SharePointSite memberships (not SharePoint Groups, but sites)?

I get a big long repeating table of DL/SGs and Site memberships (not useful). Do you do regular profile imports? Have you done one in a while?

Re: Permissions/Access restrictions based on users and groups

lanijade — Sun, 19 Jul 2009 03:53:35 GMT

We only have one DL (the one that is getting returned by the webservice) and that was set up by someone else and really is a legacy that I want to get rid of but just haven't got round to it yet. All other groups in AD are of the SG type. I haven't tried changing a DL to an SG but will give that a go shortly.

Re: Permissions/Access restrictions based on users and groups

warrtalon — Sun, 19 Jul 2009 03:42:13 GMT

Well, tell me this. If all you see are DLs for yourself and not any SGs, why is it that you HAVE DLs that you are a member of that are not SGs? How many do you have? I don't see much reason for a DL when you have SharePoint, because it does the same thing a DL does. Do you have some reason for having DLs that you're a member of at all? What happens if you go change a DL that shows up in this web service to an SG. Does it disappear?

This web method is part of the UserProfileService, which pulls from the SSP profile database. It pulls its info from AD via the profile import. That is why I had thought at first that it only would pull SGs, but you pointed out that it pulls DLs. I have no idea why the profile import would pull in that info, but maybe it's because it can't differentiate the object in AD, since it obviously refers to them all as DistributionLists. I can say 100% that I am seeing SGs.

Re: Permissions/Access restrictions based on users and groups

lanijade — Sun, 19 Jul 2009 03:33:53 GMT

Ok, this is good to know that SGs should appear as well.... I was thinking...what's the point if you can only get DLs? Anyway, no, I don't see any security groups at all. Any suggestions why this might be happening?

It's strange because in our intranet we follow the process of adding users to AD security groups > then add AD security groups to SharePoint groups. All these AD security groups appear in SharePoint when I'm assigning permissions so why wouldn't they be coming back in through the web service?

Yes - I have too seen some major messes in AD, luckily we are only small at the moment and I'm in control of SharePoint and AD and I'm anal so I won't let it get messy :-)

Re: Permissions/Access restrictions based on users and groups

warrtalon — Sun, 19 Jul 2009 01:56:03 GMT

Are you sure? I double-checked, and you are right that it does pull in DLs, but for me, it also pulls in SGs. I am VERY familiar with both, because it's one of the first things I look at when I walk into a new environment. My current client had (and still has) a mess, because they had duplicates for every group - one a DL and one an SG. Theyhad not been assigning email address to the SG, but I have no idea why. So, they had to add/remove people from 2 groups each time, and when I went to use groups in SP, I could only get to some random ones that actually were SGs, but none of them had email addresses. They're soon to reconcile all of them and get everything turned into an SG while cleaning up the dupes.

Anyway, I had some of the previous DLs converted to SGs (a simple radio button toggle), and some others I got created as SGs as new. All of my personal DL and SG memberships show up, which in the end is more powerful. The fact that SP can only leverage SGs, but this web service allows us to compare both SGs and DLs could be an extra boon.

Do you not see _any_ security groups? Not a single group that shows up for you in this web service's results can be used for permissions in SP?

Re: Permissions/Access restrictions based on users and groups

lanijade — Sun, 19 Jul 2009 00:00:43 GMT

Hi Clayton,

Just to be clear. I have checked this against AD. It is pulling back only DLs from AD. We also have AD groups created which are of the security group type. So in AD, when you create a group you can either make it a DL or a security group. The security groups are not being pulled back through this web service. I'm not referring to SharePoint groups here.

Just wondering if this is standard?

Thanks.