1 / 22

SharePoint 2010 Permissions

SharePoint 2010 Permissions. Keith Tuomi. profile. SharePoint Consultant / Developer at itgroove. Developing Online Systems since 1991. 10 years as dedicated .NET/Microsoft Developer . 110% SharePoint focused for 7 months, with no looking back. KEITH TUOMI. Blog. Twitter. Web.

raja
Download Presentation

SharePoint 2010 Permissions

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. SharePoint 2010 Permissions • Keith Tuomi

  2. profile • SharePoint Consultant / Developer at itgroove • Developing Online Systems since 1991 • 10 years as dedicated .NET/Microsoft Developer • 110% SharePoint focused for 7 months, with no looking back KEITH TUOMI Blog Twitter Web • yalla.itgroove.net • @itgroove_keith • www.itgroove.net

  3. Access Management Terminology • - Permissions- single units of access that represent specific tasks that can be performed • at the list, site, or personalization level - permission levels are made up of sets of permissions - SharePoint ships with a core list of permissions that cannot be edited, added to or deleted • - Users- smallest value to which access can be granted- value corresponds to an account in Active Directory or another host application for user accounts • - Groups- a set of users who will have identical access needs • Securable objects - levels within SharePoint 2010 that can be “locked down,” or secured, by setting specificuser access • Inheritance- used to describe how user access is created by default within SharePoint • - Security Trimming & Indexing- SharePoint will only show you search results for content you have access to, and for which SharePoint understands the security • - Audiences- Used to target content to specific sets of users - Defined in the User Profile Service Application in Central Admin- NOT a security setting but simply a way to display pertinent content to specific users

  4. Topology Web Application

  5. Permission Levels • Permission Levels are collections of permissions • - level of access that users with the assigned permission have is based on the permissions that make up the permission level. • Defined at the site collection • - Managed by Site Collection Administrators- Customize an existing permission level- Copy an existing permissions level and edit the copy- Create a new permission level “from scratch”

  6. Default Permission Collection

  7. Web Application Policy • - Central Administration > Manage Web Applications • - Configures policy-based access to all content in a web application • - Allow and Deny- Deny overrides any allow permissions • - SharePoint 2010 allows you to define policies for any available permission

  8. Site Security • - Site Actions > Site Permissions • - Groups are established at the site collection- Can be given permissions at the site level- Permission inherits down from there- When you create a group you do not have to assign a permission- A group without a permission at the site can still be assigned permissions to another securable object • - Create a sub-site- Unique or Inherited Permissions

  9. Default Groups • - Owners: Full Control • - Visitors: Read • - Members: Contribute • - Features add more groups (Designers, etc.) • - The Members group is the “default members groups”

  10. SharePoint Groups • - Enable hierarchical membership management- Create a group named Site Managers> owned by site collection administrators > membership managed by owner (site collection administrators)- Site members (and other groups)> Owned by Site managers > Membership managed by owner (Site Managers) • - Enable Access Requests- Add link to request page for the group- Optionally enable auto-accept of access requests • - Control Member Visibility

  11. Group Management Comparison • - Active Directory- Technical user interface (AD Users & Computers)- No provisioning (requests, workflows)- Difficult delegation of membership management- Centralized security (group membership) management • - SharePoint- Non-technical user interface- Easy delegation of group membership management- Optional provisioning of membership requests- Unified view of SharePoint groups & users- Only applies to SharePoint

  12. Using Active Directory Groups • - Assigning permissions directly to AD groups- Possible but not recommended> Assumes that content will always be hosted in a web application using AD as its authentication provider • - Nest Active Directory groups in SharePoint groups- Add to a SharePoint group and give permissions (recommended)> user > Active Directory group > SharePoint group- Must be a security group (not a distribution group) > Distribution groups are expanded and then must be kept in sync • - Distribution groups can be used to create audiences

  13. To Nest or Not to Nest • Users > Active Directory Group > SharePoint group • Ideal world: Synchronization of membership between Active Directory and SharePoint groups • “Intranet” sites: AD groups  SP groups to define access - Add site to users’ My Sites with personalization site links - Support easy management of access - Add site to users’ My Sites with personalization site links - “Collab” sites: Add users directly to SP groups - Provide My Site visibility - Provide visibility of user in user information list - Provide visibility to site owners and members - Support collaboration

  14. List & Library Permissions • - List > List Settings / Library > Library Settings • - Stop Inheriting Permissions- Copies inherited permissions as initial explicit permissions- Can reset with Inherit Permissions button • - Ribbon Actions for Selected Group(s)/user(s)- Grant Permissions- Remove User (or group) Permissions- Edit User (or group) Permissions- Check permissions: Resultant set of permissions- Anonymous Access

  15. Folder & Item/Document Security • Items & Documents will be referred to in this presentation as “Items” unless specific difference needs to be highlighted • - Change permissions on a folder or item- Item > Arrow > Manage Permissions- When viewing the item properties in SharePoint > Edit Permissions

  16. Inheritance • - Permissions (role assignments) are inherited from the parent object • - Inheritance can be broken- All permissions are explicit - Any changes to parent do not affect the child object • - Inheritance can be reinstated- All customizations (explicit permissions) are lost • - Use inheritance wherever possible - Simplicity, coherence, maintainability

  17. Effective Permissions • - SharePoint access is based on a per URI (web address) basis- The permission to the URI is all that matters- These kids are wild: no need to ask the parents permission - No equivalent to NTFS (Windows folder security) Traverse Folder permission • - Explicit <or> Inherited- One or the other- Different than NTFS (inherited + explicit) • - Check Effective Permissions button- Shows you the actual effective permission level

  18. Security Trimming & Indexing • - The SharePoint interface and search results are security-trimmed- User don’t see what they do not have permission to read • - Item-level permissions on pages in a Page Library- Problem: A Web Part displays items> Users don’t see items they don’t have access to > The crawler sees all items in the web part and indexes them- When inheritance is stopped within a site, all Web Part content on ASPX pages is not indexed by default- Site Settings > Search and Offline Availability > Indexing ASPX Page Content

  19. Permission Levels • - Available only with Publishing Features turned on Publishing Feature Collection • ManageHierarchy • RestrictedRead • Publishing Feature • Approve

  20. SharePoint Security Notes - Columns can not be secured uniquely (out of the box) • - Performance - Conditional formatting - Related Lists - Third party solutions - Audiences • - Make content visible to users - Effect can be close to security, but it is not security

  21. Information Management Policies • In-place records management • - New in SharePoint 2010 - Record library still supported for dedicated record libraries - Enable the feature at the site collection level - Declare records management attributes • - Site Collection - Folder - Content type - Supports security at the document level without permissions - Information rights policies • - Relies on Active Directory Rights Management Services

  22. Conclusion • Remember: limited access is for SharePoint to manage unique permissions. It neither means someone is limited to access something, nor does it mean they have limited access to something. Ignore it • Permissions can be defined at creation of a site (more options) but can’t be during creation of a new list or library (in the GUI at least) • When in doubt, check effective permissions • Help your users, set a valid email account for ‘manage access requests’ - Finally, build sites based on a ‘team’ of people.  Setting individual permissions shouldn’t be something you do all the time, it should be in the ‘odd times needed’ not the goto action

More Related