<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
		>
<channel>
	<title>Comments on: Be careful when manipulating your SPWeb&#8217;s RoleAssignments</title>
	<atom:link href="http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignments/feed/" rel="self" type="application/rss+xml" />
	<link>http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignments/</link>
	<description>The "Why" and "How" of SharePoint Development</description>
	<lastBuildDate>Wed, 28 Oct 2009 06:40:11 +0000</lastBuildDate>
	<generator>http://wordpress.com/</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: =8)-DX</title>
		<link>http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignments/#comment-133</link>
		<dc:creator>=8)-DX</dc:creator>
		<pubDate>Wed, 06 Aug 2008 11:07:14 +0000</pubDate>
		<guid isPermaLink="false">http://hristopavlov.wordpress.com/?p=40#comment-133</guid>
		<description>The same thing goes for folders - deleting the SPRoleAssignment for a folders SPListItem object (also ISecurable) will also remove all of a user&#039;s roles for the subfolders.

This is how to identify the &quot;Limited Access&quot; SPRoleDefinition (and leave it there).
(role_def.Type == SPRoleType.Guest &amp;&amp; (role_def.BasePermissions != SPBasePermissions.FullMask))

I&#039;m not sure the code you have there will work for folders -&gt; I kept getting and error saying &quot;You cannot add a role assignment with an empty SPRoleDefinitionBinding collection to the object&quot; or something like that.

My workaround was to:

A if there is already an SPRoleAssignment for the user then I
  1.Go through the RoleDefinitionBindings collection and remove all except limited access
  2.If I have some new role to add, add it now.
  3.If I added some roles or there was limited access do Update. otherwise remove the role assignment

B if there is no SPRoleAssignment - create a new one for the user.


SPUser current_user; //assuming you have a user object
SPListItem folder_item; // assuming you have the SPListItem object for the given folder
SPRoleDefinitionBindingCollection nove_role_def = new SPRoleDefinitionBindingCollection(); // add some roles to this.. or add specific roles later.

SPRoleAssignmentCollection roles = folder_item.RoleAssignments;

				SPRoleAssignment role_for_current_user = null;
				bool is_previous_role = false;
				for (int i = 0; i &lt; roles.Count; i++)
				{
					SPRoleAssignment role = roles[i] as SPRoleAssignment;

					if (role.Member.ID == ((SPMember)current_user).ID)
					{
						if (!is_previous_role)
						{
							is_previous_role = true;
							bool role_is_not_empty = false;
							bool is_limited = false;
							//role.RoleDefinitionBindings.RemoveAll();
							for (int j = 0; j &lt; role.RoleDefinitionBindings.Count; j++)
							{
								SPRoleDefinition role_def = role.RoleDefinitionBindings[j];
								if (role_def.Type == SPRoleType.Guest &amp;&amp; (role_def.BasePermissions != SPBasePermissions.FullMask))
									is_limited = true;
								else
								{
									role.RoleDefinitionBindings.Remove(j);
									j--;
								}
							}

							foreach (SPRoleDefinition role_def in new_role_defs)
							{
								role_is_not_empty = true;
								role.RoleDefinitionBindings.Add(role_def);
							}

							if (role_is_not_empty &#124;&#124; is_limited)
								role.Update();
							else
							{
								roles.Remove(i);
								i--;
							}

						}
						else
						{
							roles.Remove(i);
							i--;
						}
					}
				}

				if (!is_previous_role)
				{
					bool role_is_not_empty = false;
					role_for_current_user = new SPRoleAssignment(
						current_user.LoginName,
						current_user.Email,
						current_user.Name,
						current_user.Notes);
					role_for_current_user.RoleDefinitionBindings.RemoveAll();
					foreach (SPRoleDefinition role_def in new_role_defs)
					{
						role_is_not_empty = true;
						role_for_current_user.RoleDefinitionBindings.Add(role_def);
					}
					if (role_is_not_empty)
						roles.Add(role_for_current_user);
				}
			}</description>
		<content:encoded><![CDATA[<p>The same thing goes for folders &#8211; deleting the SPRoleAssignment for a folders SPListItem object (also ISecurable) will also remove all of a user&#8217;s roles for the subfolders.</p>
<p>This is how to identify the &#8220;Limited Access&#8221; SPRoleDefinition (and leave it there).<br />
(role_def.Type == SPRoleType.Guest &amp;&amp; (role_def.BasePermissions != SPBasePermissions.FullMask))</p>
<p>I&#8217;m not sure the code you have there will work for folders -&gt; I kept getting and error saying &#8220;You cannot add a role assignment with an empty SPRoleDefinitionBinding collection to the object&#8221; or something like that.</p>
<p>My workaround was to:</p>
<p>A if there is already an SPRoleAssignment for the user then I<br />
  1.Go through the RoleDefinitionBindings collection and remove all except limited access<br />
  2.If I have some new role to add, add it now.<br />
  3.If I added some roles or there was limited access do Update. otherwise remove the role assignment</p>
<p>B if there is no SPRoleAssignment &#8211; create a new one for the user.</p>
<p>SPUser current_user; //assuming you have a user object<br />
SPListItem folder_item; // assuming you have the SPListItem object for the given folder<br />
SPRoleDefinitionBindingCollection nove_role_def = new SPRoleDefinitionBindingCollection(); // add some roles to this.. or add specific roles later.</p>
<p>SPRoleAssignmentCollection roles = folder_item.RoleAssignments;</p>
<p>				SPRoleAssignment role_for_current_user = null;<br />
				bool is_previous_role = false;<br />
				for (int i = 0; i &lt; roles.Count; i++)<br />
				{<br />
					SPRoleAssignment role = roles[i] as SPRoleAssignment;</p>
<p>					if (role.Member.ID == ((SPMember)current_user).ID)<br />
					{<br />
						if (!is_previous_role)<br />
						{<br />
							is_previous_role = true;<br />
							bool role_is_not_empty = false;<br />
							bool is_limited = false;<br />
							//role.RoleDefinitionBindings.RemoveAll();<br />
							for (int j = 0; j &lt; role.RoleDefinitionBindings.Count; j++)<br />
							{<br />
								SPRoleDefinition role_def = role.RoleDefinitionBindings[j];<br />
								if (role_def.Type == SPRoleType.Guest &amp;&amp; (role_def.BasePermissions != SPBasePermissions.FullMask))<br />
									is_limited = true;<br />
								else<br />
								{<br />
									role.RoleDefinitionBindings.Remove(j);<br />
									j&#8211;;<br />
								}<br />
							}</p>
<p>							foreach (SPRoleDefinition role_def in new_role_defs)<br />
							{<br />
								role_is_not_empty = true;<br />
								role.RoleDefinitionBindings.Add(role_def);<br />
							}</p>
<p>							if (role_is_not_empty || is_limited)<br />
								role.Update();<br />
							else<br />
							{<br />
								roles.Remove(i);<br />
								i&#8211;;<br />
							}</p>
<p>						}<br />
						else<br />
						{<br />
							roles.Remove(i);<br />
							i&#8211;;<br />
						}<br />
					}<br />
				}</p>
<p>				if (!is_previous_role)<br />
				{<br />
					bool role_is_not_empty = false;<br />
					role_for_current_user = new SPRoleAssignment(<br />
						current_user.LoginName,<br />
						current_user.Email,<br />
						current_user.Name,<br />
						current_user.Notes);<br />
					role_for_current_user.RoleDefinitionBindings.RemoveAll();<br />
					foreach (SPRoleDefinition role_def in new_role_defs)<br />
					{<br />
						role_is_not_empty = true;<br />
						role_for_current_user.RoleDefinitionBindings.Add(role_def);<br />
					}<br />
					if (role_is_not_empty)<br />
						roles.Add(role_for_current_user);<br />
				}<br />
			}</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Links (7/10/2008) &#171; Steve Pietrek - Everything SharePoint</title>
		<link>http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignments/#comment-112</link>
		<dc:creator>Links (7/10/2008) &#171; Steve Pietrek - Everything SharePoint</dc:creator>
		<pubDate>Fri, 11 Jul 2008 00:30:50 +0000</pubDate>
		<guid isPermaLink="false">http://hristopavlov.wordpress.com/?p=40#comment-112</guid>
		<description>[...] Be careful when manipulating your SPWeb’s RoleAssignments [...]</description>
		<content:encoded><![CDATA[<p>[...] Be careful when manipulating your SPWeb’s RoleAssignments [...]</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: FuzzLinks.com &#187; Be careful when manipulating your SPWeb’s RoleAssignments « SharePoint Internals - Hristo Pavlov’s Blog</title>
		<link>http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignments/#comment-110</link>
		<dc:creator>FuzzLinks.com &#187; Be careful when manipulating your SPWeb’s RoleAssignments « SharePoint Internals - Hristo Pavlov’s Blog</dc:creator>
		<pubDate>Thu, 10 Jul 2008 14:36:41 +0000</pubDate>
		<guid isPermaLink="false">http://hristopavlov.wordpress.com/?p=40#comment-110</guid>
		<description>[...] http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignment... [...]</description>
		<content:encoded><![CDATA[<p>[...] <a href="http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignment.." rel="nofollow">http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulating-your-spwebs-roleassignment..</a>. [...]</p>
]]></content:encoded>
	</item>
</channel>
</rss>
