How strictly is Client Object Model functionality Security Trimmed & Person (User) object resolution?

Question

I have a Silverlight Webpart Application running on a Sharepoint2010 Page. The purpose of this webpart is to take a spread of different sections of data and condense it into a more easily usable form.

One aspect of the application needs to define a manager for the List Item it references. As far as the list is concerned, it is some static data plus a Person or Group Field.

Here I hit a massive roadblock. I know that I can pull user and group information to (for example) pull all users in a specific group to populate the list of available managers, but it appears to be security trimmed similarly to the standard permission set of SharePoint as a whole (meaning, you need permission to view and edit permission sets in order to do anything with them).

I have tested this with code from this link and two accounts, a full control user and a user with view access. http://msdn.microsoft.com/en-us/library/ee538244.aspx

If it is at all possible i would like to use the client object model for this entire application, rather than delve too deeply into web services to accomplish my goal (mainly since i am much more familiar with it), however my research has indicated there is no way to run code as an administrator in the client object model.

Therefore the only way this would be possible, is to fully understand the limitations of the client object model calls in regards to user security, or determine an alternate means to either resolve or pull a User object based on name within the scope of the client object model.

Thank you for any help, and for reading through my wall of text!

Update:

Thanks Per Jakobsen for the knowledge, then all that's left, is to know if there's a way to pull a User object given the User Name, or if a web service is literally the only option.

Answer 1

The client object model uses the standard SharePoint security and don't allow you to run with elevated priviledges.

Who has access to see members of groups are defined at the group and the default is only members can see who are members.

You can change this by going to:

Site Actions -> Site Settings -> People and groups -> Click the Groups header in Quick launch -> Click edit next to the group you want to change