如何在无SharePoint环境下用.NET通过REST API设置SharePoint 2013文件夹权限

Hey there! I’ve walked through this exact scenario with plenty of developers, so let’s break it down step by step—you don’t need a local SharePoint deployment at all. All you need is access to your SharePoint 2013 site’s REST API, a .NET project, and an account with enough permissions to manage folder access (like Site Collection Admin or Full Control on the target library).

Key Prerequisites #

• Your SharePoint 2013 site URL (e.g., http://sp2013.yourdomain.com/sites/yourTeamSite)
• A .NET project (Console App, ASP.NET, etc.—I’ll use a Console App example for simplicity)
• The System.Net.Http and System.Net.Http.Headers NuGet packages (add them if they’re not already in your project)

Step 1: Set Up Authenticated HTTP Client #

SharePoint 2013’s REST API typically uses NTLM authentication for on-prem environments. Here’s how to configure an HttpClient to handle this:

using System.Net.Http;
using System.Net.Http.Headers;
using System.Net;

// Use current user's credentials, or specify explicit ones
var handler = new HttpClientHandler
{
    UseDefaultCredentials = true,
    AllowAutoRedirect = true
};

// If you need to use specific credentials instead:
// handler.Credentials = new NetworkCredential("yourUsername", "yourPassword", "yourDomain");

var client = new HttpClient(handler);
client.BaseAddress = new Uri("http://sp2013.yourdomain.com/sites/yourTeamSite/_api/");
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json;odata=verbose"));

Step 2: Break Folder Permission Inheritance #

By default, folders inherit permissions from their parent library. You need to break this first (choose whether to keep existing permissions or start fresh):

async Task BreakFolderPermissionsInheritance(HttpClient client, string folderServerRelativeUrl, bool keepExistingPermissions = true)
{
    var endpoint = $"web/getfolderbyserverrelativeurl('{folderServerRelativeUrl}')/breakroleinheritance(copyroleassignments={keepExistingPermissions}, clearsubscopes=true)";
    
    var request = new HttpRequestMessage(HttpMethod.Post, endpoint);
    // Request digest is required for all POST/PUT/DELETE operations
    request.Headers.Add("X-RequestDigest", await GetRequestDigest(client));
    
    var response = await client.SendAsync(request);
    response.EnsureSuccessStatusCode(); // Throws an error if the request fails
}

// Helper to fetch the required request digest token
async Task<string> GetRequestDigest(HttpClient client)
{
    var response = await client.PostAsync("contextinfo", null);
    var digestData = await response.Content.ReadAsAsync<dynamic>();
    return digestData.d.GetContextWebInformation.FormDigestValue;
}

Call this method with your folder’s server-relative URL (e.g., /sites/yourTeamSite/Shared%20Documents/ProjectA-Files).

Step 3: Fetch the Target User’s SharePoint ID #

You need the user’s unique SharePoint ID to assign permissions. Grab it using their email or login name:

async Task<int> GetUserIdByEmail(HttpClient client, string userEmail)
{
    var endpoint = $"web/siteusers/getbyemail('{userEmail}')";
    var response = await client.GetAsync(endpoint);
    response.EnsureSuccessStatusCode();
    
    var userData = await response.Content.ReadAsAsync<dynamic>();
    return userData.d.Id;
}

Alternatively, use getbyloginname('i:0#.w|yourDomain\\yourUsername') if you prefer using the user’s domain login.

Step 4: Get the Permission Level ID #

Pick the permission level you want to assign (e.g., "Contribute", "Read", "Full Control") and get its ID:

async Task<int> GetRoleDefinitionId(HttpClient client, string roleName)
{
    var endpoint = $"web/roledefinitions/getbyname('{roleName}')";
    var response = await client.GetAsync(endpoint);
    response.EnsureSuccessStatusCode();
    
    var roleData = await response.Content.ReadAsAsync<dynamic>();
    return roleData.d.Id;
}

Step 5: Assign Permissions to the Folder #

Now tie everything together—link the user and permission level to your target folder:

async Task AssignFolderPermission(HttpClient client, string folderServerRelativeUrl, int userId, int roleDefinitionId)
{
    var endpoint = $"web/getfolderbyserverrelativeurl('{folderServerRelativeUrl}')/roleassignments/addroleassignment(principalid={userId}, roledefid={roleDefinitionId})";
    
    var request = new HttpRequestMessage(HttpMethod.Post, endpoint);
    request.Headers.Add("X-RequestDigest", await GetRequestDigest(client));
    
    var response = await client.SendAsync(request);
    response.EnsureSuccessStatusCode();
}

Full Example Workflow #

Here’s how to call all these methods in sequence:

static async Task Main(string[] args)
{
    var siteApiUrl = "http://sp2013.yourdomain.com/sites/yourTeamSite/_api/";
    var targetFolderUrl = "/sites/yourTeamSite/Shared%20Documents/ProjectA-Files";
    var userEmail = "jane.smith@yourdomain.com";
    var permissionLevel = "Contribute";

    var handler = new HttpClientHandler { UseDefaultCredentials = true };
    var client = new HttpClient(handler) { BaseAddress = new Uri(siteApiUrl) };
    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json;odata=verbose"));

    try
    {
        // Break inheritance first
        await BreakFolderPermissionsInheritance(client, targetFolderUrl);
        
        // Get the user's ID
        var userId = await GetUserIdByEmail(client, userEmail);
        
        // Get the permission level ID
        var roleId = await GetRoleDefinitionId(client, permissionLevel);
        
        // Assign the permission
        await AssignFolderPermission(client, targetFolderUrl, userId, roleId);
        
        Console.WriteLine("Folder permissions assigned successfully!");
    }
    catch (Exception ex)
    {
        Console.WriteLine($"Error encountered: {ex.Message}");
    }
}

Important Tips #

• Permission Requirements: The account running the code must have Manage Permissions rights on the folder or site.
• Error Handling: Add more checks for common issues (e.g., 404 if the folder doesn’t exist, 403 if you lack permissions).
• OData Compatibility: SharePoint 2013 works best with odata=verbose—avoid using odata=minimalmetadata as it may cause unexpected errors.

内容的提问来源于stack exchange，提问作者Raja G