DoesUserHavePermissions returns false for "DOMAIN\domain users"

Question

Very strange edge case that has me perplexed. I have a web service that returns a list of permissions for a list of site urls. To determine if a user has permissions to the site I use the following code.

[WebMethod]
        public GetSiteListPermissionsResponseCollection GetSiteListPermissions(string[] siteList)
        {
            GetSiteListPermissionsResponseCollection siteListReturn = new GetSiteListPermissionsResponseCollection();
            foreach (string key in siteList)
            {
                string escapedKey = Uri.EscapeUriString(key);
                if (Uri.IsWellFormedUriString(escapedKey, UriKind.Absolute))
                {
                    bool originalCatchValue = SPSecurity.CatchAccessDeniedException;
                    SPSecurity.CatchAccessDeniedException = false;
                    try
                    {
                        using (SPSite site = new SPSite(escapedKey, SPContext.Current.Site.SystemAccount.UserToken))
                        {
                            using (SPWeb web = site.OpenWeb())
                            {
                                siteListReturn.Add(new GetSiteListPermissionsResponse(key, web.DoesUserHavePermissions(SPContext.Current.Web.CurrentUser.LoginName, SPBasePermissions.Open).ToString()));
                            }
                        }
                    }
                    catch
                    {
                        siteListReturn.Add(new GetSiteListPermissionsResponse(key, false.ToString()));
                    }
                    finally
                    {
                        SPSecurity.CatchAccessDeniedException = originalCatchValue;
                    }
                }
            }
            return siteListReturn;
        }

This works fairly well but we ran into a very strange instance in which DoesUserHavePermissions returns False. If the "DOMAIN\domain users" is used to provide access then at ONE PARTICULAR SITE the reult is false. All other sites seem to work fine.

You can add the user directly and it instantly returns a true for access but for some reason this site and this one site only will not return a true response when "domain users" is used to provide access privledges.

Any clues?

Answer 1

Aside from the possibility of this being a local config issue, what I'd try is calling SPSite.RootWeb instead of SPSite.OpenWeb().

(Just a comment, have in mind that, depending on the length of siteList, this can be slow, generating many DB roundtrips.)