You can set permissions with web service calls

Permissions Web Service

We do this in our automated site provisioning workflow! We do it across site collections so that we can leverage site templates on different collections.

If you need any examples or help, let us know

I have a requirement to do something similar to this.  My issue is that the sub-site being created by our workflow stores the new site URL in a workflow variable, and I'm trying to use that new URL reference in the URL for the Web Service call so that it's calling the web services associated with the newly created sub-site.  However, I'm unable to select a Web Method in the configuration for AddGroup since the site URL I'm trying to use technically isn't created yet until a user fills out our form and provides a site name for the new site.

How did you get around this, did you have to put the group creation and permissioning in a separate workflow that's called by the site creation workflow?

Thanks!

I did separate out those steps, but I am using a workflow variable as well to pass along the newly created URL.

What I did was put in a legit URL, so I can select the proper service, and then once set, replace the URL with the variable.

Also, you should be prompted with a dialog box if the URL contains a variable:

This gives you a chance to provide a real example of what the variable could hold.

Hope this helps!

Ok, that's what I had did at first (using legit URL to get the methods and then substitute for the workflow variable) but got some SOAP exception errors when I tried to test the workflow.

Would you suggest a pause or a wait, or is there a way to check that the site creation action has taken place before the call of web service actions are run?

We added in a pause step to allow the system to create the site. If I remember correctly, we ran into similar issues when the site creation and permission actions were in the same workflow, and that is why we separated them out.

If you are still running into issue after pausing for 5 minutes, separate out the permission steps and put them in another workflow. Then all you need to do is call that workflow and pass over the variables required. So something like this:

Hope this helps!

Looks good, I've added the pause for 5 minutes actions and going through unit testing of that change now to see if we get the same errors as before.  I appreciate the help!

This is how I currently have it set up, have added Commit Pending Changes actions also.

Commit pending changes action should really only be used just before you need to reference some data from something that a workflow updated (check out   for more details). Not sure how the rest of your workflow is designed, but you may not need them.

Also, just a thought, you could move the pause step to just before the Run in parallel action to save steps. Same thing with the commits, since you are only setting workflow variables between the steps.

Let me know how it works out for you!

Hope this helps!

Tried it out with the Pause for 5 minutes action and still receiving these "Failed to invoke web service." errors:

Try to do them one at a time rather than in parallel. I have ours setup sequential actions.

In each action set I am creating the group and then applying the group.

Have you tested the web service by doing a Run now within the web service action? Does that work?

I ran into some issues around my variables and the way I was pushing through the URL. 

When I try run now, Test Connection returns OK in results, but executing the Web method gets me a 500 Internal Server Error.

Hmmm... so it looks like it is the method that is failing. This is the tedious part, checking that the request is setup properly and that the variables are all in the right format.

First, I would validate all your variables (send them to yourself in an email via the workflow or output them with log history action) and try to see if they are what you expect. After that, you may need to step through the service call to ensure it is setup properly with the variables. I created a test site and created and added the permissions there to see that it would work.

Here is an example of one of my web service calls (usergroup.asmx  AddGroup ):

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:m="http://schemas.microsoft.com/sharepoint/soap/directory/">
<soap:Header>
</soap:Header>
<soap:Body>
  <m:AddGroup>
    <m:groupName>{WorkflowVariable:siteOwnersGroup}</m:groupName>
    <m:ownerIdentifier>{WorkflowVariable:newSiteOWNER}</m:ownerIdentifier>
    <m:ownerType>user</m:ownerType>
    <m:defaultUserLoginName>{WorkflowVariable:newSiteOWNER}</m:defaultUserLoginName>
    <m:description>
    </m:description>
  </m:AddGroup>
</soap:Body>
</soap:Envelope>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

And then to add the group to the site (permissions.asmx  AddPermission ):

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:m="http://schemas.microsoft.com/sharepoint/soap/directory/">
<soap:Header>
</soap:Header>
<soap:Body>
  <m:AddPermission>
    <m:objectName>{WorkflowVariable:newSiteURL}</m:objectName>
    <m:objectType>Web</m:objectType>
    <m:permissionIdentifier>{WorkflowVariable:siteOwnersGroup}</m:permissionIdentifier>
    <m:permissionType>group</m:permissionType>
    <m:permissionMask>-1</m:permissionMask>
  </m:AddPermission>
</soap:Body>
</soap:Envelope>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Also, I am not sure why I did not mention this before, but I created an asset in   for this awhile back. Check out Site Creation Workflow  if you want to see how I did mine.

Hope this helps!

Yea, I think I may need to get my server team involved and see what's going on.  My setup is almost identical as yours.

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:m="http://schemas.microsoft.com/sharepoint/soap/directory/">
<soap:Header>
</soap:Header>
<soap:Body>
  <m:AddGroup>
    <m:groupName>{WorkflowVariable:siteOwnersGroup}</m:groupName>
    <m:ownerIdentifier>{WorkflowVariable:newSiteOwner}</m:ownerIdentifier>
    <m:ownerType>user</m:ownerType>
    <m:defaultUserLoginName>{WorkflowVariable:newSiteOwner}</m:defaultUserLoginName>
    <m:description>
    </m:description>
  </m:AddGroup>
</soap:Body>
</soap:Envelope>

Well best of luck! It can be done so you just need to pinpoint the issue. I think you are close!

Let me know if you need anything else or have any questions.

‌ did any of the responses resolve your issue?  Are you able to mark any correct?

Hey Jessie. I would love to see how that works. Hope all is well at Nintex. 

Dean Virag