Security is the protection of information and property from theft.
9
votes
3answers
1k views
Best way to Impersonate in SharePoint
So far, I am aware of below 3 ways of performing impersonation in a SharePoint web part or page :
Using Win32 API
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool ...
9
votes
3answers
794 views
FAST Search Security Trimming of non Windows External Content Types
We have integrated a back-end web application into SharePoint 2010 using the BCS and the OOTB Web Services connector.
The data in the backend system is protected by ACLs and we need these ACLs to be ...
8
votes
2answers
1k views
Java to Sharepoint interface, with claims based authentication
I have a sharepoint server with a claims-based authentication (ADFS server).
I have a Java app that needs to push data to a sharepoint list, preferably over the REST API, and with the additional ...
7
votes
3answers
2k views
Penetration testing tool for SharePoint
Does anybody know any good penetration testing tools for SharePoint?
7
votes
1answer
263 views
How does EU Cookie law affects SharePoint Sites?
The Euorpean Union has forced a new cookie law to protect privacy of a user. The full documentation is at
Information Commissioner’s Office guidance
According to an extract from the above document,
...
5
votes
5answers
779 views
How to detect if my code is running inside SPSecurity.RunWithElevatedPrivileges
Is there a way to detect if my code is running inside SPSecurity.RunWithElevatedPrivileges?
class Foo
{
public static void Bar()
{
if (CODE_RUNS_ELEVATED)
{
Debug.WriteLine("You ...
5
votes
1answer
259 views
Why can I only login if I use “Sign in as a different user”?
Currently, I can only login directly (in any browser) with members of the Sharepoint Farm Administrators group. However, if I login as one of those administrators then login as a regular domain user I ...
5
votes
3answers
2k views
Google Analytics for an Intranet Site
I installed the Google Analytics tracking code in an intranet site, it works properly. But my concern is, are there any security risks of using it for an intranet site? simply, is it ok to use Google ...
5
votes
2answers
3k views
Why are user permissions set in AD not updated immediately to SharePoint?
I have a SharePoint 2010 Foundation installation on Windows 2008 R2 and SQL Server 2008 and using Claims and Windows authentication.
Subsites are visible only to members of a certain group. However, ...
5
votes
5answers
2k views
User Accounts Disappearing From SP Groups
We've been running into a bizarre scenario and I'm at a complete loss.
I'm a site collection admin for my division's portal. We're on a shared internal company-wide MOSS server, and I have no access ...
5
votes
3answers
344 views
Possible to security trim what web parts a user can put on a page?
Basically when you select Insert -> Web Part you get this menu:
Is it possible to determine what is available here based on a users role?
5
votes
2answers
290 views
Unique Permission Issue
This appears to be by design. I have a user who used unique permissions on a subsite and then used unique permissions on a list in the subsite. They then decided to have the subsite inherit ...
4
votes
3answers
2k views
What are the best practices for using SharePoint Groups with AD Security Groups
Does anyone here have a best practices when applying security policy to SharePoint groups? Do you use security enabled Distribution Lists in your SharePoint groups? Do you say to heck with that and ...
4
votes
2answers
1k views
Best authentication method for accessing sharepoint web from the Internet
We're planning a sharepoint intranet which will be acceded directly from our LAN, however it should be accesible from the Internet, too. What would be the best authentication method available for this ...
4
votes
1answer
3k views
Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack
this code thow an exception at "Item.Update();"
private void AddEmail()
{
site = SPContext.Current.Site;
web = site.RootWeb;
...
4
votes
1answer
111 views
SharePoint permissions reading from AD
I have a SharePoint sub web with unique permissions, within the site I have 3 SharePoint groups (Owner, Contributor and Viewers), in each of these groups I am including an Active Directory group.
...
4
votes
3answers
4k views
How to get a web.config file in a sharepoint 2010 publishing site?
I am working on a sharepoint 2010 project and I noticed in the soultion their is no web.config.
I asked one of my fellow co-workers and he mentioned something about we don't have access to to it as ...
4
votes
1answer
862 views
Hiding content from authenticated users?
I have content that I only wish to display to anonymous users.
Once the user has logged in, I would like to hide it.
Is "Audience Targeting" the right way to do this, and if so, it seems I can only ...
4
votes
2answers
781 views
Make a folder in a document library read only without using security
I have a document library with about 25,000 folders in it, each folder represents a task in our task system and is used as a document repository for those tasks.
Of the 25,000 tasks about 22,000 are ...
4
votes
1answer
217 views
Fine grained permission control using Web App Zones?
I am using SharePoint 2010 Server.
I am trying to understand (and test out) all the various options for using different authentication sources for internal and external users on a site that can be ...
4
votes
1answer
185 views
What is a good strategy for data masking?
Can anyone recommend a good strategy for data masking in SharePoint 2010?
How do you replicate live data in development and test environment whilst preserving data security and removing sensitive ...
3
votes
3answers
631 views
Securing usernames and passwords for external SQL DB
We want to ensure that we are following best practice around connecting to a custom database.
I'm not a developer as such so thought I would ask SharePoint Overflow :-).
We have several SharePoint ...
3
votes
3answers
1k views
Unable to modify SPWebApplication properties from feature receiver - Access Denied
The scope of the feature is Web.
SPWeb site = (SPWeb)properties.Feature.Parent;
site.AllowUnsafeUpdates = true;
// Set the Web Application's default error page
SPSite siteCollection = new ...
3
votes
4answers
2k views
Why is SharePoint_Shell_Access permission required to run SharePoint powershell?
So we're setting up a SharePoint farm and it seems our admin accounts require access SharePoint_Shell_Access role on SQL.
http://technet.microsoft.com/en-us/library/ee806878.aspx
...
3
votes
3answers
1k views
How do you allow Content Authors to add Javascript to a Publishing Page?
We have an internet-facing, SharePoint 2010, Publishing Site. The content authors that maintain the site are JavaScript savvy web designers. They would like to be able to add JavaScript to publishing ...
3
votes
3answers
304 views
Multiple login prompts are driving users nuts
What are the typical causes of multiple login prompts on sharepoint sites?
We have a production site where users who login outside of the domain (from home) are prompted multiple times (3 or so ...
3
votes
1answer
2k views
Anonymous access = huge web services security hole?
My company uses SharePoint for their public website by allowing anonymous access. Some of our lists and document libraries have permissions to only allow certain users to be able to access them. I'm ...
3
votes
1answer
531 views
What permissions do I need for a user to see all entries in a list where typical users can see only their own submissions?
I have a list where users can create and see their own items, but not other users' items. I, being the site owner, can see all items. How can I give specific users within a Sharepoint Group the ...
3
votes
2answers
1k views
Is it possible to limit the visibility of list items to not only just me (the author), but anyone from my company too?
I have a custom list on a SharePoint 2010 extranet site which users from various external companies can add items to. The list's Permission Settings page allows you to make all items visible to all ...
3
votes
1answer
3k views
How to enable access to subsite only to certain users or groups?
I created an intranet site based on Sharepoint Foundation 2010 which is based on mixed authentication (Windows and Form Based).
It has a main site where all logged users have access and there are ...
3
votes
6answers
474 views
Security around Web Parts
I have been looking to wrap security around web parts. I already have security wrapped around documents so only the correct people see the allowed documents. The problem lies when a user does not ...
3
votes
1answer
560 views
SSL and Forms Based Authentication in WSS 3.0
I have a FBA application and we would like to use SSL with it.
By default, does setting SSL in IIS use SSL for the entire site, or just the login?
We think we'd like to use SSL for the entire visit ...
3
votes
2answers
3k views
Session time out for Windows Authentication
I have a requirement where we need to timeout the SharePoint sessions (security validation). Since I am using Windows Authentication I am not able to use session timeouts (as Windows authentication ...
3
votes
1answer
593 views
more than one attachment field
We are planning to retire one of our old fashion tools and currently evaluating Sharepoint 2010.
in our current tool, we have 3 different attachment sections two of which are visible to customer, and ...
3
votes
3answers
1k views
SPSecurity.RunWithElevatedPrivileges that elevates outside of the current web application context
Im not sure if this is possible without impersonating a user/service account (and therefore hard coding credentials) that has farm level access...
The situation is I want to access an SPSite in ...
3
votes
1answer
217 views
users with Contribute getting 403 forbidden error
This is something I haven't seen in 4 years. Users in SP Group "Accounting" with Contribute access getting 403b forbidden error. It was working fine until this morning. However, I log in as sp admin ...
2
votes
1answer
703 views
How do I remove all users from an SPGroup object?
I have an SPGroup object populated, how can I remove all members from the group, so that essentially I start with a fresh group.
I can't delete and recreate it, so I need a way to work with the ...
2
votes
4answers
1k views
SharePoint Groups vs AD groups - further examples
From this post - http://www.sharepointoverflow.com/questions/1781/what-are-the-best-practices-for-using-sharepoint-groups-with-ad-security-groups
It was mentioned by Mr Samuel Yates that there are ...
2
votes
2answers
1k views
How effective is locking down _vti_bin
I've come across a roadblock where the maintainer of the Sharepoint installation has restricted access to the _vti_bin folder (i.e. denied for all users). I am using SPservices to access the ...
2
votes
3answers
434 views
Column Level Security Products
I am looking for recommendations on products that handle column level security. What is the best product out there? Any input will be greatly appreciated.
Thanks!
2
votes
1answer
176 views
How to get (admin) access to a SP2010 Site
Someone managed to delete all the user permissions from a SP2010 (sub)Site, including their own (this person was the only site admin).
How do you give (the site owner or an administrator account) ...
2
votes
1answer
39 views
RoleAssigments are being assigned by default to all new pages
I am pretty new to SharePoint, so please let me know if there is some more info or clarification required. I am creating a webapplication with certain SP groups, libraries and pages in that order by ...
2
votes
1answer
142 views
Can I use UAG to isolate my customers' portals on our extranet?
It sounds like the best practice for isolating different customers on an extranet is to use separate site collections for each customer (as is recommended in every answer to this question). If I have ...
2
votes
4answers
1k views
Limit users permission in their own my site
we want to limit users from changing the settings on a particular library in their my site. Am i right in thinking that to do so we will need to remove them from the site collection administrators ...
2
votes
2answers
103 views
How to set authentication model to allow cross-domain access?
How do I change the security settings to allow cross-domain on the same web-server?
I have multiple instance or site collections on the same server but want to make sure that web-services to ...
2
votes
5answers
64 views
Is it possible to create a Blacklist in the usermanagement?
We use a Sharepoint 2010.
We want to prevent the Site Administrators assign a specific role (e.g. "Domain\All Users") to a site.
So is it possible to create (maybe with custom code), a blacklist for ...
2
votes
1answer
164 views
SPSecurity.CatchAccessDeniedException = false: Does Sharepoint keep this setting?
When I add SPSecurity.CatchAccessDeniedException = false; this disables the redirection to a login site.
Does Sharepoint keep that setting until I set it to "true" or just as long until the object is ...
2
votes
2answers
74 views
Should I patch my intranet SharePoint?
SharePoint patching is a hassle and takes a lot of time to test and deploy,
My SharePoint is an intranet site (within my organization's premises).
Some fellow IT admins advised me to patch only ...
2
votes
1answer
88 views
Extending SharePoint groups metadata?
In an application I'm building, I have to create and manage groups based on business rules. Each group must have properties like managers (yes, several managers) and members, with some other ...
2
votes
1answer
312 views
What is neccesary to write to filesystem from a Web Part?
How can I allow a web part to create a file on a unc path? I have a location with ntfs permissions set to everyone\full control and am getting 'access denied' messages.
The SP2010 app pool is running ...
