Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Here is my requirement: I have a list of region/offices that is used to model the organization structure of a company. This list is used as a lookup in a list of manager users: so each manager is assigned to a region that he/she will manage. That means each of the node below will have manager assigned to them.

Europe Region
--East Europe
----Greece Office
----Turkey Office
--West Europe
----England Office
----Netherlands Office
--North Europe
America Region
...
...

Then I will have another list, that holds the staff(personnel) information for these regions/offices.

Name
Phone
Email
Age
Region (Choice)
Office (Choice)

What I need is to implement some policy so that the managers of the regions/offices will only be able to enter/update the information of their staff.

That means, the manager of Turkey office will not be able to enter data for Greece office. Or the manager of Europe Region will not be able to see the data of America region. Which should need a hierarchial permission structure.

How can i provide this kind of permission structure in SharePoint. The only solution that comes to my mind is developing a custom NewForm and EditForm, then do the permission checks in code-behind.

What are your ideas? Any alternatives come to mind?

share|improve this question
2  
Sounds like a fantastic candidate for SharePoint Managed Metadata Claims Provider no ? mmcp.codeplex.com –  Francois Verbeeck Dec 18 '12 at 12:01
    
hi @FrancoisVerbeeck, this is the first time i've heard about MMCP. Do you think i can implement my requirement using this? –  ozdogan Dec 18 '12 at 12:57
    
It might be interesting to give a try. Otherwise, I would go with event receiver to have something up & running in a short amount of time. Finally, why not create folders (per office), relying on a library instead of list ? You could apply permissions on each folder to ensure only the manager of that office have the ability to edit and give a rollup read-only view without folder for everyone as the default view ? –  Francois Verbeeck Dec 18 '12 at 13:08

1 Answer 1

up vote 1 down vote accepted

Quick idea: since it would seem that you have specific people/groups that should edit a specifi item of the list you should be able to assign a item level permission to an item so that only the espected user may edit it, right?

If that is the case - and if no other better solution is found - you can try to build an item event receiver that will update the item permission set based on the selected region. That way whenever an item is modified, the new permission would be applied.

Would a similar solution be acceptable?

Edit: about the cancel adding event - you could use the item adding event to check the user and redirect to an error page when appropiate. For example:

public override void ItemAdding(SPItemEventProperties properties)
{
    base.ItemAdding(properties);            
    if (!UserCanAddThisItem(.....))
        {
            properties.Status=SPEventReceiverStatus.CancelWithRedirectUrl;               
            properties.RedirectUrl = "/_Layouts/myCustomPage.aspx";           
        }       
 }

This was based on this article: source. As you can see, you can define a custom page and then redirect the user as required. Remember to set the status to CancelWithRedirectUrl.

About the idea of developing a custom page and manage all the security inside that page, as said in the comments you could do it. It all comes down to a compromise: can you afford to constrain your user to use only the custom page? If the answer is yes, you could just remove all write permission from the target list and manage all edit/insert operation in a custom form. You will have to use RunWithElevatedPrivileges, but you would then be sure that no one will be able to add an item outside your managed page (or at last, no super-farm-admin-user will).

share|improve this answer
    
thanks for the enlightining idea. but your suggestion is valid for updating items. what about the first entry of the item. how can i deny, manager of another office to enter personnel info for other office –  ozdogan Dec 17 '12 at 12:51
1  
Cannot you use an item adding event and cancel the add if the region doens't match the expected one for the current manager? You should also be able to send back an appropiate error message. –  SPArchaeologist Dec 17 '12 at 13:13
1  
I am pretty sure that if you give custom permission to the list items the lookup is based to, you could obtain the result you describe. That said there should be a simplier way. Let me think about it. –  SPArchaeologist Dec 17 '12 at 15:37
1  
Well, nothing out of the box comes to mind. Problem is: how would SharePoint associate the current user with an user in the maneger list (to use for the filter)? There is a custom field available on codeplex that may (never used it) provide some help: here. I am also wondering if claims could be used somehow. –  SPArchaeologist Dec 18 '12 at 9:25
1  
@ozdogan, the page would have an evident advantage: it would easly support any new requirement you may add in the future, while a out of the box solution can reach its limits pretty fast. There ise one mayor problem that comes to mind though: you need to ensure that no user can bypass the page and add the items thru the list standard new item form. –  SPArchaeologist Dec 18 '12 at 11:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.