Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have a subsite that contains a dozen or so document libraries and want to restrict one user so that they can only access one of them. Obviously I could create custom permissions on all twelve but I want to find a way where we only break the permissions inheritance on that once document library.

Normal users are members of a group that gives them Approve level access to the entire site and I've tried creating a new group that gives the restricted user Approve access to just that document library. The group appears in the site's permissions list as having 'limited access' rights, but when they log into Sharepoint they cannot see the site at all.

EDIT- I've discovered that the user can browse directly to the document library, but cannot open the site's home page or see it in navigation. Is there any workaround for this?

share|improve this question

2 Answers 2

To achieve your editied response, you'll need to give the user Read rights to the root of the site/subsite. You'll need to break permissions inheritance from all lists and libraries and remove that person/group from them. You'll be left with the user only having access to the site home page and the document library they need to.

share|improve this answer

By default, Sharepoint creates 3 Security Groups which automatically filters down to all content below the root site.

These are : Owners, Members, Visitors.

Now, Normally, you would add Authenticated users to the Visitors group so that EVERYONE can view everything.

In order to achieve your purpose, I suggest you create a AD Group for Intranet Users and EXCLUDE ths limited access user from this group.

Next, remove Authenticated users and/or domain users from the Visitors Sharepoint group. Add the newly created Sharepoint Group to the visitors group.

This way, you only need to break inheritance on the specific doc library, and add the 'limited user' to this group with specific permissions.

Hope this helps.

Fox

share|improve this answer
    
That's pretty much what i've done. The problem is that the user ends up with rights to see the document library, but not the site it's in. –  iheartsharepoint Jul 22 '11 at 7:49
    
Why dont you just add the user to the Visitors group in that web? Do This: Browse to Rootsite/etc/etc/sitetobesecured/_layouts/user.aspx . Break Inheritance here. Add 'limited user' to permission here. –  Fox Jul 22 '11 at 8:11
    
Because that'll then give read access to all the other libraries. Ideally they should be invisible, or at the very least impossible to open. –  iheartsharepoint Jul 22 '11 at 8:13
    
Mmm, I understand your dilemma. Unfortunately there's no easy answer. If only Sharepoint has a "DENY ACCESS" permissions such as NT, the answer would be simple..... You can get very very fancy and go over the top by developing a quick and dirty HTTPModule if you want? –  Fox Jul 22 '11 at 9:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.