Search code examples
outlookoffice365exchangewebservices

How to properly create/update public folder via EWS using admin impersonation?


I cannot create any public folder in case when I set proper permission (through WebUI) to that user (in my case admin).

But when I try to update public folder`s 'EffectiveRights' to add permission level to that user I cannot do it. Which request I need to send to update user permission level on public folder or add proper 'EffectiveRights' on that public folder?

Example of the request:

POST outlook.office365.com/EWS/Exchange.asmx

Content-Type:text/xml; charset=utf-8
Accept:text/xml;       charset=utf-8

BODY

<?xml version="1.0" encoding="utf-8"?>
    <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
    xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" 
    xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
        <soap:Header>
        <t:RequestServerVersion Version="Exchange2013_SP1" />
            <t:ExchangeImpersonation>
                <t:ConnectingSID>
                    <t:PrimarySmtpAddress>test@test_test.onmicrosoft.com</t:PrimarySmtpAddress>
                </t:ConnectingSID>
            </t:ExchangeImpersonation>
        </soap:Header>
    <soap:Body>
    <UpdateFolder xmlns="http://schemas.microsoft.com/exchange/services/2006/messages"
                  xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
      <FolderChanges>
        <t:FolderChange>
          <t:DistinguishedFolderId Id="publicfoldersroot" />
          <t:Updates>
            <t:SetFolderField>
              <t:FieldURI FieldURI="folder:EffectiveRights"/>
              <t:Folder>
                <t:EffectiveRights>
                  <t:CreateAssociated>false</t:CreateAssociated>
                  <t:CreateContents>true</t:CreateContents>
                  <t:CreateHierarchy>false</t:CreateHierarchy>
                  <t:Delete>false</t:Delete>
                  <t:Modify>false</t:Modify>
                  <t:Read>true</t:Read>
                </t:EffectiveRights>
              </t:Folder>
            </t:SetFolderField>
          </t:Updates>
        </t:FolderChange>
      </FolderChanges>
    </UpdateFolder>
  </soap:Body>
  </soap:Envelope>   

and the response is:

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
    <s:Header>
        <h:ServerVersionInfo MajorVersion="15" MinorVersion="20" MajorBuildNumber="1164" MinorBuildNumber="25" Version="V2018_01_08" xmlns:h="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>
    </s:Header>
    <s:Body>
        <m:UpdateFolderResponse xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
            <m:ResponseMessages>
                <m:UpdateFolderResponseMessage ResponseClass="Error">
                    <m:MessageText>Set action is invalid for property.</m:MessageText>
                    <m:ResponseCode>ErrorInvalidPropertySet</m:ResponseCode>
                    <m:DescriptiveLinkKey>0</m:DescriptiveLinkKey>
                    <m:MessageXml>
                        <t:FieldURI FieldURI="folder:EffectiveRights"/>
                    </m:MessageXml>
                    <m:Folders/>
                </m:UpdateFolderResponseMessage>
            </m:ResponseMessages>
        </m:UpdateFolderResponse>
    </s:Body>
</s:Envelope>

another one example:

POST outlook.office365.com/EWS/Exchange.asmx

Content-Type:text/xml; charset=utf-8
Accept:text/xml;       charset=utf-8

BODY

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages"
               xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types"
               xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Header>
    <t:RequestServerVersion Version="Exchange2013_SP1" />
            <t:ExchangeImpersonation>
                <t:ConnectingSID>
                    <t:PrimarySmtpAddress>test@test_test.onmicrosoft.com</t:PrimarySmtpAddress>
                </t:ConnectingSID>
            </t:ExchangeImpersonation>
  </soap:Header>
  <soap:Body>
    <m:UpdateFolder>
      <m:FolderChanges>
        <t:FolderChange>
          <t:FolderId Id="AAEuAAAAAAAaRHOQqmYRzZvIAKoAL8RaAwCOXNGsJPKoS5iTrqfBNvbzAACDSr4rAAA=" />
          <t:Updates>
            <t:SetFolderField>
              <t:FieldURI FieldURI="folder:PermissionSet" />
              <t:Folder>
                <t:PermissionSet>
                  <t:Permissions>
                    <t:Permission>
                      <t:UserId>
                        <t:PrimarySmtpAddress>test@test_test.onmicrosoft.com</t:PrimarySmtpAddress>
                      </t:UserId>
                      <t:PermissionLevel>Editor</t:PermissionLevel>
                    </t:Permission>
                  </t:Permissions>
                </t:PermissionSet>
              </t:Folder>
            </t:SetFolderField>
          </t:Updates>
        </t:FolderChange>
      </m:FolderChanges>
    </m:UpdateFolder>
  </soap:Body>
</soap:Envelope>

and the response:

<?xml version="1.0" encoding="utf-8"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
    <s:Header>
        <h:ServerVersionInfo MajorVersion="15" MinorVersion="20" MajorBuildNumber="1143" MinorBuildNumber="18" Version="V2018_01_08" xmlns:h="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"/>
    </s:Header>
    <s:Body>
        <m:UpdateFolderResponse xmlns:m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:t="http://schemas.microsoft.com/exchange/services/2006/types">
            <m:ResponseMessages>
                <m:UpdateFolderResponseMessage ResponseClass="Error">
                    <m:MessageText>Access is denied. Check credentials and try again., Underlying MAPI stream threw exception</m:MessageText>
                    <m:ResponseCode>ErrorAccessDenied</m:ResponseCode>
                    <m:DescriptiveLinkKey>0</m:DescriptiveLinkKey>
                    <m:Folders/>
                </m:UpdateFolderResponseMessage>
            </m:ResponseMessages>
        </m:UpdateFolderResponse>
    </s:Body>
</s:Envelope>

Solution

  • Because your trying to create folders in publicfoldersroot no user has rights by default to do that (this is to stop people messing up the Public Folder root). So if you want your user test@test_test.onmicrosoft.com you would need to first grant them rights to do that on the Root folder either using the EAC or Add-PublicFolderclientPermissions. I would suggest you first create a folder in the Root using the EAC and then get your code to create child folders of that, from a development point of view this is easier to cleanup when you need to delete everything and test again then trying to clear the whole root hierarchy each time.

    Also only you second example will work because EffectiveRights is a calculate property so can't be updated, all you can do is update the underlying DACL of the folder which is what you second request is doing