Security is the protection of information and property from theft.

learn more… | top users | synonyms

1
vote
1answer
164 views

Securing a forms Authentication Internet site

I have an internet site using MOSS 2007/win 2008/SQL 2005. Users are authenticated using forms authentication. All authenticated users are able to browse pages like: ...
1
vote
2answers
1k views

Security warning for JavaScript and CSS file?

I am using SharePoint Server 2007 Enterprise with Windows Server 2008 Enterprise. And I am developing using VSTS 2008 + C# + .Net 3.5 + ASP.Net + JavaScript (jQuery). I met with the following ...
1
vote
1answer
32 views

How to manage security for on-prem provider hosted apps that are published to SharePoint Online?

I have a provider hosted app where the web site is running locally (not in azure) and the SharePoint app will be published to SharePoint online. (so user connects to SharePoint online site, clicks on ...
1
vote
0answers
53 views

SharePoint Search BDC / BCS Model with Item Level Security Using SharePoint Groups

I have a BDC / BCS model that I use for indexing content with SharePoint Search. In the model, I assign item-level security using the method described on this MSDN article: ...
1
vote
1answer
78 views

How to configure security (IIS, token, etc.) for a website that uses SharePoint 2013 REST API?

I have a website that uses the SharePoint 2013 REST API to render list data (via JQuery AJAX) on the website. It is pretty straightforward and works fine, but my challenge is figuring out the security ...
1
vote
0answers
45 views

Unique security scope number inside library

I have seen a recommendation, that there should be no more security scopes than 5000: For most farms, we recommend that you consider lowering this limit to 5,000 unique scopes. For large lists, ...
1
vote
1answer
39 views

How to enable non-admin users to store custom application data at a farm level?

When a normal (non-admin) users click my custom-made ribbon button in a document library, I would like to write the document library's information to some persistent farm-wide store (or at least a ...
1
vote
0answers
15 views

Control all user traffic to Sharepoint Online

We are working on a gateway solution aimed for Sharepoint Online to control all user traffic and possibly, do changes on requests and responses. Is there any way to enforce/limit connections to ...
1
vote
1answer
37 views

Managing SharePoint groups at site/site collection level

SharePoint groups are created at site collection level and are assigned to a site. By site collection level it refers to root site. So, reframing the above sentence we get:- SharePoint groups are ...
1
vote
1answer
1k views

The remote server returned an error: (401) Unauthorized. on new App

I created a new app by following this tutorial http://blogs.msdn.com/b/bspann/archive/2013/01/19/asp-net-mvc-based-apps-for-sharepoint-2013-on-premises.aspx I was able to press F5 and it showed me ...
1
vote
1answer
53 views

Strange SharePoint behaviour regarding “Check Permissions” in a web part

I have a web part in which I am displaying users from User Profile Service which is synced with AD. In my code I get all the users in current site and then see if they are part of any group. If they ...
1
vote
0answers
23 views

Fine-tuning SP2013 Document Library permissions

I have the need to give access to a role for creating documents and folders in a document library and giving access to another role to create documents (but not folders) How would I go about doing ...
1
vote
0answers
100 views

FBA Custom login page to use 2 factor authentication - simplified

User provides an username/password. Should validate those and only then proceed to step 2. User provides an additional authentication token. If succeeds user is authenticated against SharePoint and ...
1
vote
1answer
157 views

Why the security trimming doesn't apply?

It seems that the security trimming doesn't apply for the Quick Launch in SharePoint 2013. I've created 2 lists with broken role inheritance and assigned permissions to a different group for each ...
1
vote
0answers
28 views

Log sharepoint security events to the windows event log

Is it possible, through either a configuration setting or some minor conding, to make SharePoint log all security events to the Windows Event Log? I'm primarily interested in events that deal with ...
1
vote
0answers
34 views

In SharePoint 2013 is there a security group that allows full access to all content in a farm by default?

I'm setting up a SharePoint 2013 development server and I've added my account to the Farm Admin group. In prior versions this meant that I had access to all content in the farm by default. It looks ...
1
vote
0answers
158 views

How to restrict access to edit attachments in lists?

We have Windows SharePoint Services 3.0 SP 3 (12.0.0.6608 from CA) on Windows 2003 Server R2 EE. In the main we use our WSS as sort of book of problems. And by book of problems, i mean that there is ...
1
vote
1answer
93 views

sharepoint hosted app pages authorization

I have multiple pages in a SharePoint 2013 hosted app. I need to restrict access to some of the pages to certain group. what is the best practice to do this?
1
vote
0answers
24 views

I can add users to the Active users in the portal, but not to People and Groups - Sharepoint 2013 on Office365

I'm using SharePoint 2013 on Office365. I've added two users in the Admin Portal, both with identical attributes (except name, email address etc.!) However, when I go onto my site and try to add ...
1
vote
0answers
267 views

Are SharePoint 2007 or 2010 vulnerable to cross-site request forgery out of the box?

An IBM Rational AppScan against a WSS 3.0 installation indicates that it has detected a cross-site request forgery (CSRF/XSRF) vulnerabilities on many pages, for example ...
1
vote
1answer
77 views

Default Security Groups on Site Creation from Web Service

I am creating SharePoint Team Sites using SharePoint Web Services as I cannot use the object model for this solution (I do not have SharePoint installed on the server where the sites are created ...
1
vote
0answers
223 views

Steps to deny anonymous access to _vti_pvt directory iis7

The service.cnf file found in the _vti_pvt directory has the default permission settings which may lead to an unauthorized access to the file What are the steps to deny anonymous access to _vti_pvt ...
1
vote
2answers
552 views

Is it possible to add a security trim that filters by user groups?

In my left hand side bar I have 3 links to downloads- one for each of three different companies. I need each company to log in and see only the one link to their companies downloads - not all 3 links ...
1
vote
0answers
97 views

Why is AddComment on SocialCommentManager throwing SPException?

When I try to add a comment using SocialCommentManager, the AddComment method throws an SPException saying "The security validation for this page is invalid. Click Back in your Web browser, ...
1
vote
1answer
83 views

Sharepoint: Retrieve info on assigned user policy

A question from stackoverflow Case: Create a User Policy in SharePoint 2010 Web Application Management: assign 'Full read' to user XXX for site YYY; Call SiteData.asmx/GetContent for site YYY and ...
1
vote
0answers
56 views

Is use of PageView web part poses a security risk?

I have two internal web applications in same domain, I want to integrate them within sharepoint using a PageView webpart. Some how the security community of the organization believes it would ...
1
vote
1answer
254 views

Webapp design for internet, intranet and extranet?

I am a beginner in Sharepoint and I must conceive a Sharepoint solution. I need to have an Intranet for employees as well as an access point for collaborators to a particular site in this intranet. ...
1
vote
1answer
110 views

Encrypting the search index(es) - any advice?

I have read up on how to configure SQL Server TDE to encrypt SharePoint content that resides in databases, but what about encrypting the search indexes (which reside on the file system)? Does anyone ...
1
vote
0answers
283 views

SPUtility.GetPrincipalsInGroup not working when claims authentication is enabled

Method SPUtility.GetPrincipalsInGroup can be used to resolve users that belongs to a AD Group. However, when claims authentication is enabled, this method doesn't work as expected. Is there another ...
1
vote
1answer
2k views

Why does a workflow cancel with “access denied” for all but users with Full Control accesse?

I am working with an existing SharePoint deployment that has a convoluted security structure. After cleaning up permissions a bit, an approval workflow for absence requests is somehow not working for ...
1
vote
1answer
1k views

Exception occurred while connecting to wcf endpoint

I get very strange exception "exception occured while connecting to wcf endpoint .... access denied". only when I go to any Document Library. I logged on as Administrator and I have added "Full ...
1
vote
0answers
429 views

Get Permissions with client object model

i want to add a permission on a folder who's inside a document library with javascript/jquery/client object model. The problem i have is, its a custom permission level created when some feature is ...
1
vote
1answer
177 views

Authentication - multiple web domains

We use claims based authentication and have one application running, say www.abc.com This application authenticates against AD via claimns provider. We would like to deploy another web site: ...
1
vote
0answers
38 views

Secure Data from Farm Admins and Database Admins

I am working with a client whose farm admins and database admins may not be approved to view information in one of the site collections due to governmental regulations. Therefore, he would like to ...
1
vote
0answers
753 views

Importing site gives “Security check failed in OnFolderImport” error

I'm using the SharePoint Content Deployment Wizard (2.8 beta) and have successfully exported a site. Now I'm trying to import the site and it gives me the following messages in the log and isn't ...
1
vote
2answers
561 views

Best practices on Intranet & Extranet

Should these 2 be on same farm (so that deployment is not a big issue or file share) How is the security managed? Is there any good article that can help me determine best practice?
1
vote
0answers
263 views

Editing navigation from site Actions results in error in MOSS 2007

When I or any other user on any machine tries to change the navigation through Site Actions - Modify Navigation, an error occurs stating "The security validation for this page is invalid. Click ...
1
vote
1answer
182 views

Basic authentification only for a specific listening ip address?

One of my customer has a requirement which is to allow basic authentication because a outdated SSO and reverse proxy tool (changing this is not an option today). This is true for external access (both ...
1
vote
1answer
3k views

InfoPath forms not working when ViewFormPagesLockDown enabled

We have an internet facing, SharePoint 2010, Publishing Site that is accessible to anonymous users. On this site, we have some InfoPath 2010 List forms, exposed using the InfoPath Form Web Part, that ...
1
vote
1answer
882 views

SharePoint 2010 list view caching to bypass 1000 item security scope limit

my current customer has a setup where he has multiple related lists and libaries. the structure is something like the following: An Audit Item has 0:n Issue items has 0:n Documents An Issue has 0:n ...
1
vote
2answers
2k views

SharePoint 2010 Insights (PerformancePoint): '401 Unauthorized' error on invoking 'Run Dashboard designer'

Environment: SharePoint 2010 on Windows 2008 R2 Standard + SQL Server 2008 R2 I am trying to setup the BI infrastructure Lab as outlined in this article: ...
0
votes
3answers
1k views

Securing SharePoint for External Access

We are exploring the possibility of making our Intranet available to our employees outside of our network (and not over VPN). Besides firewalls/forward proxies and such (like the Threat Management ...
0
votes
1answer
91 views

Can SPPersistedObject settings be updated by normal users if ran with elevated privileges?

I have a custom ribbon icon "Enlist" deployed to each document library. A normal (i.e. non-admin) user can click this icon; when he does, I would like to permanently save the document library ...
0
votes
2answers
384 views

Is an UpdatePanel a bad decision?

After talking to a few people, and asking around here, I feel like the only way to securely do calls asynchronously is with an updatepanel. (Context: Creating an Upvote/Downvote system on SharePoint ...
0
votes
2answers
660 views

Sharepoint SPWeb rename - Exception SPException - The security validation for this page is invalid

When attempting an SPWeb rename I receive the following SPException: Exception SPException - The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and ...
0
votes
2answers
5k views

Stop inheriting permissions programatically

I want to set read permissions to some sharepoint groups to a list. For existing sites I did it manually, Stop Inherit permissions. Then on groups I chose the groups and edited their permissions, ...
0
votes
2answers
206 views

Is it possible to grant security roles through an event receiver?

I have a requirement to grant a department contribute to their department parent & child sites. The catch is, they also want to be able to grant & remove contribute to outside department ...
0
votes
1answer
53 views

Can Active Directory Upgrade lead to problems with SharePoint?

Are there compatibility issues between SharePoint version and Active Directory version? I have a scenario with MOSS 2007 and Active Directory 2000. I will upgrade Active Directory to 2012. I ...
0
votes
3answers
204 views

Denying the manage rights permission

I'm trying to fullfill a requirement which forces the use of Active Directory groups. I'm having issues getting to where I want to be. Upon creation of a new site, I'm going to use AD groups to ...
0
votes
3answers
5k views

removing NT AUTHORITY\authenticated users vs all authenticated users and adding domain group instead

I have a root site collection and under the "Style Resources Readers group" i have the NT AUTHORITY\authenticated and the all authenticated users . Are these the same groups but with different ...