User Management Event - Give permissions to a Sharepoint Group

arduk:

 Did you ever find a resolution to this?  I'm getting the same error.  My SharePoint group is created successfully but I can't add users to it.  Thanks.

I think that I have worked out what is happening, but it may be unique to my scenario - I will outline what I think is happening, but note that I haven't really had time to confirm this....

In my scenario, I have a list of users/groups stored in a database - my process queries the database and gets back a list of the users or groups which is loaded into an XML field. I then loop over the user management event passing in each group, and removing it from the list until there are none left. The list of users contained both domain users, and also the names of sharepoint groups.

It seems that the permissions would be granted successfully if there was only one type of object in the database - ie if I had ONLY domainusenames in the database, then it would work successfully. Likewise if I had ONLY sharepoint groups, it would work successfully. The problem seemed to occur when I had a combination of sharepoint groups and domainusernames in the database. As soon as there was a change in the type of object that it had to grant permissions to, an error would be thrown.

So, using examples to illustrate this if I queried the list, and they came back in the following order:
SPGroup1
SPGroup2
domainusername1
domainusername2
The permissions would be granted correctly to SPGroup1 and SPGroup2, but when it tried to grant to username1, an error would be thrown.

Similarly, the values were returned in the following order:
domainusername1
domainusername2
SPGroup1
SPGroup2
The permissions would be granted correctly to username1 and username2, but would fail when trying to grant to SPGroup1

From this, I assume that it uses different method to find the sharepoint groups than it does to find domain users, and that if it starts looking in the domain, it assumes that is where all users/groups will be, and if it starts looking in Sharepoint, then it assumes that all groups will be found there, when it encounters an object that doesn't exist in the location that it is looking, it throws the error.

Would be great if this could be confirmed by someone from K2 - it is currently extremely difficult to set permisssions on an item for multiple users/groups, which makes me wonder if I am missing something??

Based on my findings above, there are a couple of workarounds:
1. Only give permissions to domain users and/or domain groups - this is currently what I am thinking, however so far I haven't tried assigning permissions to both a domain user AND a domain group - for all I know at this stage it may fail as well, however I suspect that it will work based on the fact that they are both pulled from Active Directory.

2. Configure 2 user management activities, and have an indicator in the database to say if it is sharepoint or AD groups - you would then have to pull only AD groups and pass that to one user management activity, and the other user management activity would only have sharepoint groups - again this is completely untested.....

Hope this helps.....let me know if you come up with anything else, as this will be something that I run into again I am sure, and I would really like a nice way of handling it...

OK, so I have now tried this with domain groups and domain users, and it seems to work fine.

I think the key to this is visible in the wizard - just not necessarily obvious...

in the screenshot below (Apparently I can't upload screenshots, so you will have to use your imagination on this one...). In the Sharepoint User Management wizard, run it in advanced mode, and go to the screen which is title "Manage Users and Groups". Note the Source column - if the source is "UserOrGroup" then it will look in AD for the user/group. If the source is "Group" it will look in Sharepoint for the name of the group.

I suspect when you are getting the error, that the source must be set incorrectly.

Unfortunately, this is not going to help me out of the situation, as the whole point of storing this information in the DB was that I could have both Sharepoint and AD users/groups, and pick these up at run time. This would allow certain users to be able to maintain the list of people who are given access to a particular item.

Again, let me know if you find something different!

I notice the same issue on the newest release of blackpearl. It appears to me, the best way to handle this is to write your own C# dll, and put it into the GAC and consume it during process execution.

you are dead on.  It must be "Group" not "UserOrGroup".  I seem to have changed it one version of a workflow to "Group" but I have no Idea how I did it.    How do you edit the source field?

After much head banging I figured it out.

If you need a group, click the browse button not the ... button. From there pick any random group. Once done, go back in, and change it to whatever you need (mine is a smart object derived from a SharePoint list of groups).

If you are reading this and are still stuck please ask for more explanation. I'd be happy to help. We also have a ticket open on this topic.

Willner001, thanks for posting back your solution!

I'm having a similar issue with trying to use the User Management event.

I have an Infopath form that has a Person/Group picker that can have one or more people selected. When the form is submitted, the first activity in the process has a User Management event to add these people to a Sharepoint group. When I only have one person it works. However, when I have multiple people I get the error: ... The User/Group does not appear to be discoverable.

I'm using the AccountId field of the Person/Group picker, which contains the value of domainlogin name. I've tried concatenating the AccountId field into another form field separated by semicolons, but that doesn't even work with one person.

I'm trying to do this using K2 Studio without writing code.

Any help would be appreciated.

Does it work if you make a copy and just have a second data event?

IE one for user and one for manager.

If I followed your post, you can get one in...

I was just suggesting doing that twice.

If you want to remote into my dev system tomorrow, I'd be happy to show you the little bit I know.