I've got a site with two document libraries. I have users set up in two Active Directory groups, and mapped those groups to two Sharepoint groups. (i.e. the only member in the SP group is an AD group).
On the site, SP Group A and SP Group B both have read permissions. They can both see the wiki home page just fine. SP Group A has Read permission on Library A and Open permission on Library B. SP Group B has Open permission on Library A and Read permission on Library B.
If TestUser1 is a member of both Active Directory groups, and therefore a member of both SharePoint groups, they somehow get Open permissions on Library B. SharePoint is not negotiating between the permissions, it is just picking the first one it comes to.
Is there a better design for this?
I tried eliminating the Open permissions, but then my library list view web parts on the home page display useless error messages. I want users to know that the other library exists, but not let them see into the contents if they shouldn't.