Microsoft CRM 2011, Get origin of privileges for a user - dynamics-crm-2011

Question

I'm retrieving all privileges for a user with RetrieveUserPrivilegesRequest.
This works fine, and I get all privileges assigned to a certain user.
In addition I would need to know the origin of each of those privileges. Meaning that I want to know from which SecurityRole (can be multiple) every privilege derives. In the next step I would need to know if the SecurityRole is directly assigned to the user or if it derives from a Team the user is part of.
Any help would be much appreciated!

Answer 1

You can make this and it should work.
The relashionship goes in this way:
privilege --> privilege.role <-- role --> role.user <-- user.
and
privilege --> privilege.role <-- role --> role.team <-- team --> team.user <-- user
So with this, I will show you with fetchXml, you can use LinQ or QE. You need to ask, first which are the roles the user have:
<fetch mapping="logical" count="50" version="1.0">
<entity name="role">
<attribute name="roleid" />
<link-entity name="systemuserroles" from="roleid" to="roleid">
<link-entity name="systemuser" from="systemuserid" to="systemuserid">
<filter>
<condition attribute="systemuserid" operator="eq" value="{YOUR-USER-GUID}" />
</filter>
</link-entity>
</link-entity>
</entity>
</fetch>
Now you have the user's roles, with those, for each rol, you ask what privileges the user have.
<fetch mapping="logical" count="50" version="1.0">
<entity name="privilege">
<attribute name="privilegeid" />
<link-entity name="roleprivileges" from="privilegeid" to="privilegeid">
<link-entity name="role" from="roleid" to="roleid">
<filter>
<condition attribute="roleid" operator="eq" value="{THE-ROLE-GUID}" />
</filter>
<link-entity name="systemuserroles" from="roleid" to="roleid">
<link-entity name="systemuser" from="systemuserid" to="systemuserid">
<filter>
<condition attribute="systemuserid" operator="eq" value="{FOREACH-YOUR-GUID}" />
</filter>
</link-entity>
</link-entity>
</link-entity>
</link-entity>
</entity>
</fetch>
If you need to know the privileges the team have, then you need to query against the team, because the team is the owner of the roles.
First the teams the user belongs to:
<fetch mapping="logical" count="50" version="1.0">
<entity name="team">
<attribute name="teamid" />
<link-entity name="teammembership" from="teamid" to="teamid">
<link-entity name="systemuser" from="systemuserid" to="systemuserid">
<filter>
<condition attribute="systemuserid" operator="eq" value="{YOUR-USER-GUID}" />
</filter>
</link-entity>
</link-entity>
</entity>
</fetch>
And then, for each team the user belongs to, ask for the roles the teams have:
<fetch mapping="logical" count="50" version="1.0">
<entity name="role">
<attribute name="roleid" />
<link-entity name="teamroles" from="roleid" to="roleid">
<link-entity name="team" from="teamid" to="teamid">
<filter>
<condition attribute="teamid" operator="eq" value="{YOUR-TEAM-GUID" />
</filter>
</link-entity>
</link-entity>
</entity>
</fetch>
I will like to know, why are you trying to do this, because it may be a better approach, because this is quite heavy, if you need to know anything else just let me know, hope this can help you.