• June 23, 2015

Custom Security Roles

Contributor is often too generic to match business needs.   Below are 4 custom security roles with more granular purpose.   Running the below PowerShell will create the roles (if missing) for a given web URL. 

Enjoy! 

• NoDelete = Contribute without delete
• AddOnly  = Contribute without delete or edit
• EditOnly = Contribute without add or delete
• NoEdit   = Contribute without edit

# #############################################################################
# NAME:		AddCustomRoles.ps1
#
# COMMENT:  This script creates two Custom Access levels for
#			a given SharePoint URL.
#
#			* NoDelete = Contribute without delete
#			* AddOnly  = Contribute without delete or edit
#			* EditOnly = Contribute without add or delete
#			* NoEdit   = Contribute without edit
#
# REQUIRE:  Permission to unlock account
# USAGE:    .\AddCustomRoles.ps1 http://sharepoint/sites/team
#
# #############################################################################
[CmdletBinding()]
Param(
	[Parameter(Mandatory=$True,Position=1)]
	[string]$url
)
Write-Host "Opening $url ... " 
$web = Get-SPWeb $url
Write-Host "OK" -ForegroundColor Green
#### CREATE NODELETE
$nd = $web.RoleDefinitions |? {$_.Name -eq "NoDelete"}
if ($nd) {
	Write-Host "Found NoDelete" -ForegroundColor Green
} else {
	Write-Host "Missing NoDelete" 
	Write-Host "Adding NoDelete ..." 
	$noDeleteRole = New-Object "Microsoft.SharePoint.SPRoleDefinition"
	$noDeleteRole.Name = "NoDelete"
	$noDeleteRole.Description = "Can view, add, and update list items and documents."
	$noDeleteRole.BasePermissions = "AddAndCustomizePages,AddDelPrivateWebParts,AddListItems,BrowseDirectories,BrowseUserInfo,CreateAlerts,EditListItems,EditMyUserInfo,ManagePersonalViews,Open,OpenItems,UpdatePersonalWebParts,UseClientIntegration,UseRemoteAPIs,ViewFormPages,ViewListItems,ViewPages,ViewVersions"
	$web.RoleDefinitions.Add($noDeleteRole)
	Write-Host "OK" -ForegroundColor Green
}
#### CREATE ADDONLY 
$ao = $web.RoleDefinitions |? {$_.Name -eq "AddOnly"}
if ($ao) {
	Write-Host "Found AddOnly" -ForegroundColor Green
} else {
	Write-Host "Missing AddOnly" 
	Write-Host "Adding AddOnly ..." 
	$addOnlyRole = New-Object "Microsoft.SharePoint.SPRoleDefinition"
	$addOnlyRole.Name = "AddOnly"
	$addOnlyRole.Description = "Can view and add items and documents."
	$addOnlyRole.BasePermissions = "AddAndCustomizePages,AddDelPrivateWebParts,AddListItems,BrowseDirectories,BrowseUserInfo,CreateAlerts,EditMyUserInfo,ManagePersonalViews,Open,OpenItems,UpdatePersonalWebParts,UseClientIntegration,UseRemoteAPIs,ViewFormPages,ViewListItems,ViewPages,ViewVersions"
	$web.RoleDefinitions.Add($addOnlyRole)
	Write-Host "OK" -ForegroundColor Green
}

#### CREATE EDITONLY 
$eo = $web.RoleDefinitions |? {$_.Name -eq "EditOnly"}
if ($eo) {
	Write-Host "Found EditOnly" -ForegroundColor Green
} else {
	Write-Host "Missing EditOnly"
	Write-Host "Adding EditOnly ..." 
	$EditOnlyRole = New-Object "Microsoft.SharePoint.SPRoleDefinition"
	$EditOnlyRole.Name = "EditOnly"
	$EditOnlyRole.Description = "Can view, and update list items and documents."
	$EditOnlyRole.BasePermissions = "AddAndCustomizePages,AddDelPrivateWebParts,BrowseDirectories,BrowseUserInfo,CreateAlerts,EditMyUserInfo,ManagePersonalViews,Open,OpenItems,UpdatePersonalWebParts,UseClientIntegration,UseRemoteAPIs,ViewFormPages,ViewListItems,ViewPages,ViewVersions"
	$web.RoleDefinitions.Add($EditOnlyRole)
	Write-Host "OK" -ForegroundColor Green
}

#### CREATE NOEDIT 
$ne = $web.RoleDefinitions |? {$_.Name -eq "NoEdit"}
if ($ne) {
	Write-Host "Found NoEdit" -ForegroundColor Green
} else {
	Write-Host "Missing NoEdit"
	Write-Host "Adding NoEdit ..." 
	$NoEditRole = New-Object "Microsoft.SharePoint.SPRoleDefinition"
	$NoEditRole.Name = "NoEdit"
	$NoEditRole.Description = "Can add, view and delete list items and documents."
	$NoEditRole.BasePermissions = "AddAndCustomizePages,AddDelPrivateWebParts,AddListItems,BrowseDirectories,BrowseUserInfo,CreateAlerts,DeleteListItems,DeleteVersions,EditMyUserInfo,ManagePersonalViews,Open,OpenItems,UpdatePersonalWebParts,UseClientIntegration,UseRemoteAPIs,ViewFormPages,ViewListItems,ViewPages,ViewVersions"
	$web.RoleDefinitions.Add($NoEditRole)
	Write-Host "OK" -ForegroundColor Green
}

• June 23, 2015
• 2 Comments
• Uncategorized

• April 9, 2015

Query remote User Profile with PowerShell and REST API

The below code leverage SharePoint 2013 REST /_api/ to get User Profile detail remotely.   WebClient issues the HTTP GET and saves XML response.   Parsing XML gives full profile detail which can be exported or saved with other functions.   Hope this helps! 

NOTE – Remember to replace “sharepoint2013” with target farm DNS and “domain\” with Active Directory domain.

function getRemoteUserProfile ($user) {
	# Config
	$url = "http://sharepoint2013/_api/SP.UserProfiles.PeopleManager/GetPropertiesFor(accountName=@v)?@v='domain\$user'"
	$file = "c:\temp\response.html"
	
	# WebClient
	$wc = New-Object System.Net.WebClient
	$wc.UseDefaultCredentials = $true
	$wc.Proxy.Credentials = $wc.Credentials
	$wc.DownloadFile($url, $file)
	# Parse
	$x = Get-Content $file
	$upp = $x.entry.content.properties.UserProfileProperties
	$costcenter = ($upp.element |? {$_.Key -eq "costcenter"}).Value
	$division = ($upp.element |? {$_.Key -eq "division"}).Value
	$department = ($upp.element |? {$_.Key -eq "department"}).Value
	# Display
	$obj = New-Object –Type PSObject –Prop @{'User'=$user;'costcenter'=$costcenter;'division'=$division;'department'=$department}
	return $obj
}
# Main
getRemoteUserProfile "sptest1"
getRemoteUserProfile "sptest2"
getRemoteUserProfile "sptest3"

• April 9, 2015
• No Comments
• Uncategorized