We have implemented a functionality via the Core Service and we want to have this functionality only available to one SDL Tridion group (e.g. TridionGrp) and all others should get an unauthorized error.

We are able to check for the users who are directly part of this TridionGrp however how can we check if a user part of another group (e.g. TridAccess) while that other group is part of TridionGrp.

So how can we recursively check the user membership in order to validate the access?

  • Which API are you using? Is this TOM.Net (for example from a template or event system module) or the Core Service?
    – Quirijn
    Jan 8 '14 at 22:29
  • Core Service API
    – Hiren Kaku
    Jan 8 '14 at 22:35


If Peter is correct, my answer makes no sense of course! I will leave it for now until Hiren has confirmed that the group memberships are indeed expanded automatically.

Original answer

As far as I know, the only way to do this is to go through the group memberships recursively. For example (untested code!!)

TrusteeData trustee = (TrusteeData) client.Read(TrusteeID, new ReadOptions());
List<GroupMembershipData> groupMemberships = GetGroupMemberships (trustee);

private List<GroupMembershipData> GetGroupMemberships (TrusteeData trustee) 
    List<GroupMembershipData> memberships = new List<GroupMembershipData>();
    foreach (GroupMembershipData groupMshpData in trustee.GroupMemberships)
        subMemberships = GetGroupMemberships(groupMshpData.Group);
        if (subMemberships.Count > 0)
    return memberships;

Group memberships are automatically expanded for the current user.

So just call GetCurrentUser() and check if the relevant group is in the GroupMemberships array.

  • will GroupMemberships array contains both Tridion group as well as active directory groups?
    – Hiren Kaku
    Jan 9 '14 at 18:37
  • 1
    I'm pretty sure it's only Tridion Groups, but isn't that what Group Sync is for? Jan 10 '14 at 12:11
  • Can you please provide details on Group Sync?
    – Hiren Kaku
    Jan 10 '14 at 19:32
  • 1
    Documentation link. Basically, users will be added to the Content Manager (with the relevant groups) based on the information in your directory service. Jan 13 '14 at 9:48
  • We are using coreservice to get membership data and as suggested by you, we tried UserData currentUser1 = (UserData)_client.Read(<user id>, new ReadOptions()); however the groupmembership attribute for currentUser1 is showing as count 0. Can you please suggest what am I missing?
    – Hiren Kaku
    Jan 13 '14 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.