GetUserEffectivePermissions not working with External accounts

[FlorianLabranche]

Category

• Bug

Describe the bug

Working in a SharePoint tenant (@contosodev.com) with External users from a second tenant (@contoso.com).
When I use GetUserEffectivePermissionsAsync() with an External user, I get 0 as High and Low permission mask.

Steps to reproduce

All requests are executed on tenant contosodev.sharepoint.com

1. Using External User primary UPN ([email protected])

   • I can get the user using EnsureUserAsync("[email protected]")
     
   • But when I request GetUserEffectivePermissionsAsync("[email protected]") I got 0 as High and 0 as low :
     

2. Using External User UPN (florian.labranche_contoso.com#ext#@contosodev.onmicrosoft.com)

   • When I request GetUserEffectivePermissionsAsync("florian.labranche_contoso.com#ext#@contosodev.onmicrosoft.com") I have the following error:
     The expression "web/getusereffectivepermissions('i:0#.f|membership|florian.labranche_contoso.com" is not valid.

Expected behavior

• GetUserEffectivePermissionsAsync should work using either upn from principal account ([email protected]) or using the UserPrincipalName returned from EnsureUserAsync("[email protected]") => "florian.labranche_contoso.com#ext#@contosodev.onmicrosoft.com".
• Response should contain valid High and Low permission mask.

Environment details (development & target environment)

• SDK version: 1.10 and 1.11
• OS: Windows 10
• SDK used in: Azure function apps
• Framework: .NET 6

[jansenbe]

@FlorianLabranche : did you verify if calling the _api/web/getusereffectivepermissions(user UPN | User ID) does work for external accounts?

[FlorianLabranche]

@jansenbe : I just tried SP API.

• Using [email protected] (address from main tenant), it returns
  The user does not exist or is not unique.
• Using florian.labranche_contoso.com#ext#@contosodev.onmicrosoft.com (External UPN) returns
  The expression "web/getusereffectivepermissions('florian.labranche_contoso.com" is not valid.
  Expression seems truncated, so I tried encoding the "#" but, again it returns The user does not exist or is not unique.

But I tried using the SP LoginName i:0#.f|membership|florian.labranche_contoso.com#ext#@contosodev.onmicrosoft.com encoded and it returns me the high and low permission masks.

I looked into your code and saw that you build the SP LoginName but the UPN is not encoded.

I finally tested by encoding the UPN when calling GetUserEffectivePermissionsAsync() and it works.

var user = await PnPContext.Web.EnsureUserAsync("[email protected]");
await PnPContext.Web.GetUserEffectivePermissionsAsync(HttpUtility.UrlEncode(user.UserPrincipalName))

Note: UPN is the External one with #EXT#. Those '#' are the cause of the issue.

Conclusion:
I have a working fix on my side but I don't know if UPN should be encoded in PnPCore method or if PnPCore should call EnsureUser() to get the "true" UPN and then encode it.

[jansenbe]

@FlorianLabranche : I've implemented a fix, now using the UPN value for external users works directly with the method:

var basePermissions = await context.Web.GetUserEffectivePermissionsAsync("bert_contoso.com#ext#@fabrikam.onmicrosoft.com");

[jansenbe]

Will appear in the next nightly, closing this issue now

[FlorianLabranche]

Thank you!