Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I need to implement list item level permission based on rules something like this:

Users can access a given list item only when they satisfy the criteria/rule of this given list item. [such as users' business group(BG) is present in the item's fields]

Example:

List Item: MyDocument1
List Fields: AllowedBG= [BG1, BG2] (this is multiple choices data type)

User A: BG=BG1
User B: BG=BG3

Here UserA can access MyDocument1 because his BG is within MyDocument1.AllowedBG,
UserB cannot access because his BG is not present in the MyDocument1.AllowedBG

Note that this is only a simplified version of my domain problem. In reality we have 3 fields in the list item to check permission for each user, so it is not possible to use User Group to manage permissions.


I can think of a workaround: (not verified)

  1. Create a customized view and edit aspx page for this list with Visual Studio
  2. In the Page_Load method (or some other methods) check user's permission (need to RunWithElevatedPrivileges)
  3. If check is successful, redirect to the original view/edit form.
  4. If check is failed, send NotAuthorizedException to users

So what is the ideal/better way of implementing such rule based item level permission in SharePoint?

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

Your situation is really too complex for a good answer in this setting, and there are a lot of unanswered questions as well.

Here's the simple version: lock down the library completely, and only allow users access to its contents via elevated custom code. This means you'll need to provide a custom edit screen as well (step 3 in your scenario).

Item level security is a tricky beast, and given the complexity of your situation I don't think that's a road you want to go down. This solution gives your logic complete control over who accesses what, and eliminates back-door access.

share|improve this answer
    
Thanks for your response. What do you mean by 'there are a lot of unanswered questions' ? Do I have to provide completely custom view/edit page, or is it possible to have some 'interceptor' code before opening the view/edit page? (so I can redirect to the original page after verifying) –  Wint Jun 9 at 23:49
    
I meant a lot of unanswered questions in the business requirement, not the technical approach. The main concern I have is, where are the user/BG mappings stored. What happens if a user changes BGs? Not only do you have to go in and change security on all the affected documents, you have to figure out that the change happened in the first place. –  Derek Gusoff Jun 10 at 11:42
    
Another question is, how serious are you about security? Do you just not want Bob from Accounting to see the Marketing team's meeting agendas, or is there private and confidential data being stored? If someone URL-hacks an edit form they shouldn't be seeing (and they will), would that be a big deal? –  Derek Gusoff Jun 10 at 11:47
add comment

I think the best way to accomplish this is by setting up a workflow that allows you to implement that criteria.

You will find more information how to accomplish this in the following blog post How to Create a Workflow to Change Item Level Permissions

share|improve this answer
    
and every time someone changes business groups you have to change security on hundreds or perhaps thousands of documents. –  Derek Gusoff Jun 10 at 11:48
add comment

Use page_load function, check user permission in this function. You can't use any SharePoint feature.

share|improve this answer
    
It is really helpful if you put some code reference or links to explain your anwser –  Waqas Sarwar MCSE Jun 10 at 5:48
    
Yes it would be great if you could add a snippet of code to explain the idea –  Robert Lindgren Jun 10 at 6:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.