Managing different groups of users within same site collection

Question

We need to use WSS for different groups of clients and wondered if there is a way to seperate different groups of users, to prevent them from ever seeing each others details. An example of when this may happen is when using the people picker.

We considered seperate site collections and/or seperate sub-sites but it seems that all users are always displayed in the people picker.

Would appreciate anyone's views on the best way to manage this.

Answer 1

What about multiple Web Applications and separate SSPs? Then, you could limit the profiles you import in the SSP. I'm not sure if that will limit the search results of the People Picker or not, but it might get you started on the right path.

Answer 2

I have a few ideas as this has come up in some of the things that I am doing. Unfortunately all of the ideas require custom coding of some form. One option is removing the people picker and using a lookup field or hide the people picker field and use a dropdown control and the webservices to filter the list of users based on your criteria. It really depends on what you can do and what type of access you have to the site.

Answer 3

There are a few things you can do.

First, you can filter the people picker by specifying a SharePoint Group. Note, this is bypassed if they go into DataSheet view.

Second, in WSS the User Information store is housed at the Site Collection level, so users shouldn't have access to any data outside of the current site collection unless they have access to the second site collection. The one exception to this is site collection administrators that have access to add users, they would search for users against all users in AD or the account database.

Note, if you provision a separate application it will give you the ability to have more granular administrative permissions, but if it is the same group of administrators covering both sites then this may not matter.

Answer 4

You will need different site collections or web applications for this I think. When you've got that set up, perhaps you could try checking out different role providers. I don't know if the default AD role provider can be configured much, but you should be able create a SQL Role provider, which targets a database. If all web applications or site collections target a different sql role provider (with a different database), you should be able to get only the people you want.

Downside is, if people need access to different websites, they'll have different accounts.