SP2010 Restrict People Picker to only find accounts in SubSite

Question

I have SharePoint 2010 Foundation with a site collection for one business organization. Within that collection I have a lot of subsites. I would like to restrict members of one subsite from browsing user accounts in the people picker to only users within that subsite.

I have configured the option to only search within the site collection but need to increase that a level into the subsite.

I'm looking for suggestions on how to achieve this. Ideally I would like something that is low overhead. I looked at using AD read permissions to handle which accounts the logged in user is able to view but it was going to be a lot of overhead and complexity I would like to avoid.

Alternatively if there is a suggested way to remove/disable People picker from every possible area on the sub-site I would consider that as a solution.

TIA -Michael

Answer 1

I can't think of a way to filter the people-picker dataset beyond a site collection and I'm not aware of any site-level configuration you can set or command you can invoke to disable/remove it.

And from a run-time perspective it's renders pretty ugly mess of HTML, so you can't simply disable/remove it...and even if you could I'm not sure where you'd put it. I guess you could come come up with a custom master page with some javascript or jquery in it that renders the control disabled, hidden, or gone altogether...you could look at the SPUtility project on CodePlex for some ideas: http://sputility.codeplex.com

Alternately, and again theoretically because I've never tried this myself, you could put some logic in a hidden web part that finds and alters the rendering behavior of the people-picker controls and embed that web part in a custom masterpage that is used by the pages in the site.

Any way you look at it, a lot of work. What problem(s)/issue(s) are you trying to prevent by doing this? Maybe someone can offer an alternate approach.

Answer 2

You could create a custom user permission that disables Browse User Information and apply that as needed.

Answer 3

You can create a group for that subsite, add users to it and then assign this group to your people picker column. This will bring the users only from that group

Answer 4

IF your requirement is that people should not know who are a member of that site also, you should IMHO move to site collections. A site collection is the most scalable thing in SP (you can move it as a whole for instance) and it is the first real (hard) security barrier a user encounters (or a dev for that matter in code). And look at the name: site collection. It implies that is a collection of related sites, so members should also have some relation. If they don't they should be in a separate SC (and maybe a shared portal they can all access and through which they can get to their respective SC's). Just put up a webpart that shows the SC's you can access:

http://www.sharepoint911.com/blogs/laura/Lists/Posts/Post.aspx?ID=98

Answer 5

To continue on @Paddy 's thoughts, you can write job that populates this group with all users in the SPWeb.Users collection.

using (SPSite site = new SPSite("http://sharepoint"))
{
    SPWebCollection allWebs = site.AllWebs;

    foreach (SPWeb web in allWebs)
    {
        SPUserCollection allUsers = web.Users;
        foreach (SPUser user in allUsers)
        {
             //Add this user to the current site's all users group.
        }
        web.Dispose();
    }

}