Corey Roth [MVP]

As you may know SharePoint has its own internal security groups that you can map Active Directory users and groups into.  This lets you create custom security groups without having to store them in Active Directory.  This is not always a best practice but there are times that you may want to do this.  Using the API to do this is pretty similar to other SharePoint tasks, but the last time I tried it, I ran into some issues so I thought I would show you how I did it.

The case I am talking about today is adding a group to a site collection.  This code could easily be adapted for other uses as well.  Any web object has a property called SiteGroups which is of type SPGroupCollection.  This class has an Add method which requires a name, an owner, a default user, and a description.  Unfortunately, you can't just pass a user login to the owner and default user properties, you have to give it an SPMember object.  This means, that the user has to be added to the site collection, prior to creating a group.  I sifted through the SDK and I figured this would be simple.  In fact the code is really simple, here is what I tried first (because it seemed obvious).

This takes parameters of login, E-mail address, username, and notes.  All, I had was the username, so I passed in an empty string for the other values.  Unfortunately though, this returns the following error.

System.InvalidOperationException.  Operation is not valid due to the current state of the object.

Looking back, I think I should have been using SiteUsers instead of Users, but that is not the direction I ended up going.  I think I could use SiteUsers but I would also have to add some code to check and see if the user exists first.  What I ended up using was SPWeb's EnsureUser method.  This method simply checks to see if the user exists on the site and if the user is not there, it adds it.

Once you ensure the owner of the group is present on the site collection, adding the group is relatively easy.  Simply call the Add method, with the name, owner, default user, and description.  In this case I am using the same owner and default user.  I am getting the user from the SiteUsers collection since this is a SiteCollection.  If you were adding a group to a site, you would use Users or AllUsers.

This creates the group, but now you need to add some Active Directory users or groups to it.  This is actually pretty simple.  it takes the same parameters as the Add method does on SPUserCollection.

This is how you do it.  To make things more eloquent, I store my groups and users in an XML file and use LINQ to XML to query the data.  I may post the code for that here in the near future.