Add User to Group Workflow is overriding Group Settings/Owner

@kunalpatel Yes! You are correct - I am using "Call a web Service" to use the usergroup webservice that will allow me to use the AddUsertoGroup WebMethod. (It is all right here - https://www.c-sharpcorner.com/uploadfile/anavijai/how-to-add-user-to-sharepoint-group-using-nintex-workflow/)

The issue is that I have to enter my credentials to call the webservice which is then used for any user who in itiates the workflow. I was hoping for a solution that would allow me to use the credentials of the initiator vs those of the Workflow designer (as a side note I did check the Contorl settings under the workflow to make sure it was not impersonating - that box however is not checked).

In the scenario that i followed to build my workflow, they have you build a choice field to choose the SharePoint Group which in my case is not ideal because some sites that this Application will be implementedx on have over 400 user groups. I would like to instead use a people/groups picker to allow the user to find the group they want, however this would allow users outside of the Owner Group to be able to add users to resulting groups.

This applications purpose is the backend of an Access Request process. The user will request Access to sites using a Nintex form (well, Infopath at the moment). Currently my Admins have to process those forms and then go to 2 or 3 sites and manually add users to one of 400 possible groups. This solution will add them to the Groups more efficiently however I need to remain within the settings of the Group itself and only allow the Group Owners to be the users adding or removing group members.

In the meantime i have implemented a Run If and am using a password. Not ideal but it works like a charm - and I actually like the idea of password protecting some of these workflows. But ideally, for this one, I would like to use the credentials of the initiator in lieu of a password/column.

Any help with this would be great!

Thanks - that approach won't work. In one instance I have 7 sites all with their own Admin groups already built (the group that owns the groups we would be adding users to).

Do you know of a way to query the Owner group and if the user is in that group then set the run if statement on their membership to the group that owns the group chosen to add/remove the user?

@missymae6 

• Using web service "/_vti_bin/UserGroup.asmx", get "GetUserCollectionFromGroupResult" XML
• Using Query XML and above XML as a source, you can get:
  • XPath for Name -  /defaultNS:GetUserCollectionFromGroup/defaultNS:Users/defaultNS:User/@Name
  • XPath for UserID - /defaultNS:GetUserCollectionFromGroup/defaultNS:Users/defaultNS:User/@LoginName
• Now you can check if your user is in above collection(s) or not and build your logic accordingly
  
  • If it is then add the requested user into the group
  • If not then assign task to the users in collection to approve it (you can use lazy approval too)
    • If they approve then add the requested user into the group

Nintex Constant:

• Regular credentials password keeps getting change on a regular interval. This can cause your workflow to fail if password is incorrect.
• Also, it will show your name if you're doing some operation with your credentials. It's best practice to do updates using either service account or the users who should actually do so.
• I'll still suggest to work with your IT (AD team/IT security to request a service account and with SP Admins to grant appropriate permission at web app policy levels and in Nintex configuration)
• Also, service account's password will never change unless it has to be change by IT

I built out your suggestion above and it is only returning my information and not information about all users in the owner group of the Sharepoint Group noted. Any suggestions on returning information on the Group Owner?

@kunalpatel - I am sorry let me break it down a bit more so you can understand why I need the retreive the owner group members before allowing the workflow to proceed -

I have 7 Sharepoint sites that all work together in one large process. Most members only need access to the Home site and one other site, some members need multipl points of access. We have approx 5000 users so to keep permission maintenance organized and as easy as possible, we use a 3 tier permission system - Group A owns Group B, Group B owns most of the other groups. We also have several mini owners groups and their purpose is only to add users to one group - we will call this Group A1 and they can only add users to Group A2. Mmembers os A1 are not in Group B - they cannot add users to any other group than the one specifically built for them to control.

No one user has access to the site content - only Groups get access to site content. All permissions are done thru Groups and the ownership isn't accross the board for any one group because of the three tier system plus the A1 type groups.

My Access Request form is the only content on the site that the domain has access too. In order to see anything else the users must be in a group that has permission. (Using  a library I set up an email address which I use for my site access requests, and when an email for access comes in it launches a workflow that sends the user the link to the Access Request Form.)

When the form is received a workflow alerts the Site Admins (i set it up so the correct Admin Groups are alerted) of the new request. From there the Admin will determine which user group the requestor should be in - so the user themselves are not choosing the group.

I would like to use a People/Group Picker Field so that I do not have to build a drop down choice field for the Group selection. The admin could just pull up the group they would like to add the user to and proceed with the workflow.

This is where my issue comes in - using this People/Group Picker field allows someone from Group B (who doesn't own Group A) to choose Group A in the People/Group Picker Field and the workflow will not see they do not own that group and allow them to add users to groups they do not own. 

So you can see how this would affect my process. What i need to to confirm that the Admin that is adding the user has permission to do so and since I have tiered permissioning I can't just let people bypass then group setting because they were built purposly to control permissioning at a very high level. I need to use the Group Picker because building a choice field with all the group names would be unreasonable for the user to have to sort thru to find the correct group (Which would also mean I would have to build something for each individual Owner Group limiting what Groups they could choose which is also not ideal).

So what I think I need is a step in the workflow that returns the data on the group owner of the group that is chosen, then when it returns the name of the group that owns it, wuery the initiators group memberships and if that user is in the owner group then proceed.

Could you instruct me on how to query (XML or LDAP - I am not sure) the Owner group of the group chosen to add to, and then stoer that data in a variable, then I can run a query that will return the initiators group memberships and then compare one variable to the other and only proceed if there is a match.

I hope that makes it a little more clear :)

Thank you so much for your help on this!

That sounds promising! Could I bother you so screen shot how you grabbed the Group ID? I tried it and was unsuccessful -

I set up a Call WebService Action for WebMethod: GetGroupInfo

I am using my "add to group" field in the GroupString

I initially was storing the result in a multiline vairable but getting an error: Failed to invoke web service. Error returned from server: <soap:Fault mlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><faultcode>soap:Server</faultcode><faultstring>Exception of type 'Microsoft.SharePoint.SoapServer.SoapServerException' was thrown.

It will not take a collection type variable but it would take a Person/Group so I created a person/group variable and swapped it out for ther multi line. This time the workflow did run however the Logged Data from that Call WebService Action was blank.

How are you pulling the group information? I would like to pull all data available and see what I could pick out of it from there - if i can match Group ID's that may work, but i would need to be able to start by pulling the Intended group - get the owner group ID, then match that ID to the ID's of the groups the initiator is in, which means I would need a second (or even thrid) call webservice action that would retrieve the initiators group memberships then query xml(?) for the id's and store them in variables and then use a run if to compare them, and proceed if there is a match?

I am in a little lover my head but if i can start to pull info about the owner group I would be at least moving forward. If you can help that would be great!

I just gave it a whirl and when I execute the Run Now I get an error in the results - "The remote server returned an error: (500) Internal Server Error

Here is my setup -