Security is the protection of information and property from theft.

learn more… | top users | synonyms

10
votes
3answers
2k views

Best way to Impersonate in SharePoint

So far, I am aware of below 3 ways of performing impersonation in a SharePoint web part or page : Using Win32 API [DllImport("advapi32.dll", SetLastError=true)] public static extern bool ...
9
votes
3answers
940 views

FAST Search Security Trimming of non Windows External Content Types

We have integrated a back-end web application into SharePoint 2010 using the BCS and the OOTB Web Services connector. The data in the backend system is protected by ACLs and we need these ACLs to be ...
8
votes
2answers
2k views

Java to Sharepoint interface, with claims based authentication

I have a sharepoint server with a claims-based authentication (ADFS server). I have a Java app that needs to push data to a sharepoint list, preferably over the REST API, and with the additional ...
7
votes
3answers
6k views

Why are user permissions set in AD not updated immediately to SharePoint?

I have a SharePoint 2010 Foundation installation on Windows 2008 R2 and SQL Server 2008 and using Claims and Windows authentication. Subsites are visible only to members of a certain group. However, ...
7
votes
3answers
2k views

Penetration testing tool for SharePoint

Does anybody know any good penetration testing tools for SharePoint?
7
votes
1answer
325 views

How does EU Cookie law affects SharePoint Sites?

The Euorpean Union has forced a new cookie law to protect privacy of a user. The full documentation is at Information Commissioner’s Office guidance According to an extract from the above document, ...
6
votes
5answers
1k views

How to detect if my code is running inside SPSecurity.RunWithElevatedPrivileges

Is there a way to detect if my code is running inside SPSecurity.RunWithElevatedPrivileges? class Foo { public static void Bar() { if (CODE_RUNS_ELEVATED) { Debug.WriteLine("You ...
6
votes
2answers
1k views

ValidateFormDigest - when exactly does it need to be called?

Can someone explain to me exactly when and why I need to call SPUtility.ValidateFormDigest? Contrary to the spec, which says you need to call it before elevating privileges, I've had the following ...
5
votes
1answer
322 views

Why can I only login if I use “Sign in as a different user”?

Currently, I can only login directly (in any browser) with members of the Sharepoint Farm Administrators group. However, if I login as one of those administrators then login as a regular domain user I ...
5
votes
1answer
1k views

Sharepoint manage trust/add certificate

Hi I try to add a certificate under "central administration>security>manage trust" but I alwas get following error. The Root Certificate that was just selected is invalid. This may be ...
5
votes
5answers
3k views

Google Analytics for an Intranet Site

I installed the Google Analytics tracking code in an intranet site, it works properly. But my concern is, are there any security risks of using it for an intranet site? simply, is it ok to use Google ...
5
votes
1answer
971 views

Hiding content from authenticated users?

I have content that I only wish to display to anonymous users. Once the user has logged in, I would like to hide it. Is "Audience Targeting" the right way to do this, and if so, it seems I can only ...
5
votes
5answers
2k views

User Accounts Disappearing From SP Groups

We've been running into a bizarre scenario and I'm at a complete loss. I'm a site collection admin for my division's portal. We're on a shared internal company-wide MOSS server, and I have no access ...
5
votes
3answers
439 views

Possible to security trim what web parts a user can put on a page?

Basically when you select Insert -> Web Part you get this menu: Is it possible to determine what is available here based on a users role?
5
votes
2answers
323 views

Unique Permission Issue

This appears to be by design. I have a user who used unique permissions on a subsite and then used unique permissions on a list in the subsite. They then decided to have the subsite inherit ...
4
votes
5answers
1k views

What is the difference between SPContext.Current.Web and SPContext.Current.Site.OpenWeb()?

My colleague found that some scenarios of working with SPWeb objects depend on how you obtain them. I'm not talking of impersonating with UserTokens - that another story. But at times when you write ...
4
votes
3answers
3k views

What are the best practices for using SharePoint Groups with AD Security Groups

Does anyone here have a best practices when applying security policy to SharePoint groups? Do you use security enabled Distribution Lists in your SharePoint groups? Do you say to heck with that and ...
4
votes
4answers
3k views

Why is SharePoint_Shell_Access permission required to run SharePoint powershell?

So we're setting up a SharePoint farm and it seems our admin accounts require access SharePoint_Shell_Access role on SQL. http://technet.microsoft.com/en-us/library/ee806878.aspx ...
4
votes
2answers
2k views

Best authentication method for accessing sharepoint web from the Internet

We're planning a sharepoint intranet which will be acceded directly from our LAN, however it should be accesible from the Internet, too. What would be the best authentication method available for this ...
4
votes
3answers
2k views

How do you allow Content Authors to add Javascript to a Publishing Page?

We have an internet-facing, SharePoint 2010, Publishing Site. The content authors that maintain the site are JavaScript savvy web designers. They would like to be able to add JavaScript to publishing ...
4
votes
1answer
4k views

Unable to evaluate expression because the code is optimized or a native frame is on top of the call stack

this code thow an exception at "Item.Update();" private void AddEmail() { site = SPContext.Current.Site; web = site.RootWeb; ...
4
votes
1answer
119 views

SharePoint permissions reading from AD

I have a SharePoint sub web with unique permissions, within the site I have 3 SharePoint groups (Owner, Contributor and Viewers), in each of these groups I am including an Active Directory group. ...
4
votes
3answers
5k views

How to get a web.config file in a sharepoint 2010 publishing site?

I am working on a sharepoint 2010 project and I noticed in the soultion their is no web.config. I asked one of my fellow co-workers and he mentioned something about we don't have access to to it as ...
4
votes
2answers
1k views

Make a folder in a document library read only without using security

I have a document library with about 25,000 folders in it, each folder represents a task in our task system and is used as a document repository for those tasks. Of the 25,000 tasks about 22,000 are ...
4
votes
1answer
110 views

What has changed that the security scope limit for SharePoint 2010 is no longer 1000?

What appear to be outdated blog posts everywhere tell you to not exceed 1,000 security scopes per list. Some even provide hard evidence as to why this is a bad idea. What they seem to have in common, ...
4
votes
1answer
275 views

Fine grained permission control using Web App Zones?

I am using SharePoint 2010 Server. I am trying to understand (and test out) all the various options for using different authentication sources for internal and external users on a site that can be ...
4
votes
1answer
926 views

more than one attachment field

We are planning to retire one of our old fashion tools and currently evaluating Sharepoint 2010. in our current tool, we have 3 different attachment sections two of which are visible to customer, and ...
4
votes
1answer
247 views

users with Contribute getting 403 forbidden error

This is something I haven't seen in 4 years. Users in SP Group "Accounting" with Contribute access getting 403b forbidden error. It was working fine until this morning. However, I log in as sp admin ...
4
votes
1answer
238 views

What is a good strategy for data masking?

Can anyone recommend a good strategy for data masking in SharePoint 2010? How do you replicate live data in development and test environment whilst preserving data security and removing sensitive ...
3
votes
3answers
752 views

Securing usernames and passwords for external SQL DB

We want to ensure that we are following best practice around connecting to a custom database. I'm not a developer as such so thought I would ask SharePoint Overflow :-). We have several SharePoint ...
3
votes
3answers
3k views

Get name of Farm account using Powershell

How can I get the name of the Farm account ? I can see it listed in Get-SPManagedAccount, but do not see any properties on the SPManagedAccount objects to be able to dynamically filter by and ...
3
votes
3answers
2k views

Unable to modify SPWebApplication properties from feature receiver - Access Denied

The scope of the feature is Web. SPWeb site = (SPWeb)properties.Feature.Parent; site.AllowUnsafeUpdates = true; // Set the Web Application's default error page SPSite siteCollection = new ...
3
votes
1answer
1k views

How do I remove all users from an SPGroup object?

I have an SPGroup object populated, how can I remove all members from the group, so that essentially I start with a fresh group. I can't delete and recreate it, so I need a way to work with the ...
3
votes
3answers
1k views

Multiple login prompts are driving users nuts

What are the typical causes of multiple login prompts on sharepoint sites? We have a production site where users who login outside of the domain (from home) are prompted multiple times (3 or so ...
3
votes
1answer
2k views

Anonymous access = huge web services security hole?

My company uses SharePoint for their public website by allowing anonymous access. Some of our lists and document libraries have permissions to only allow certain users to be able to access them. I'm ...
3
votes
1answer
4k views

How to enable access to subsite only to certain users or groups?

I created an intranet site based on Sharepoint Foundation 2010 which is based on mixed authentication (Windows and Form Based). It has a main site where all logged users have access and there are ...
3
votes
1answer
1k views

What permissions do I need for a user to see all entries in a list where typical users can see only their own submissions?

I have a list where users can create and see their own items, but not other users' items. I, being the site owner, can see all items. How can I give specific users within a Sharepoint Group the ...
3
votes
2answers
2k views

Is it possible to limit the visibility of list items to not only just me (the author), but anyone from my company too?

I have a custom list on a SharePoint 2010 extranet site which users from various external companies can add items to. The list's Permission Settings page allows you to make all items visible to all ...
3
votes
1answer
270 views

SPSecurity.CatchAccessDeniedException = false: Does Sharepoint keep this setting?

When I add SPSecurity.CatchAccessDeniedException = false; this disables the redirection to a login site. Does Sharepoint keep that setting until I set it to "true" or just as long until the object is ...
3
votes
2answers
327 views

Sharepont 2013 - NTLM Logout

Our SharePoint 2013 site will not log users out unless the browser is completely closed. We are using NTLM authentication but the site is hosted, so it is external accessible. We are afraid users ...
3
votes
6answers
741 views

Security around Web Parts

I have been looking to wrap security around web parts. I already have security wrapped around documents so only the correct people see the allowed documents. The problem lies when a user does not ...
3
votes
2answers
493 views

Custom User Control and FIPS Encryption Issues

I have created several custom user controls that I added to the Redering templates of some forms in a custom solution for WSS 3. Most of these templates have codebehind and they all are correctly ...
3
votes
1answer
591 views

SSL and Forms Based Authentication in WSS 3.0

I have a FBA application and we would like to use SSL with it. By default, does setting SSL in IIS use SSL for the entire site, or just the login? We think we'd like to use SSL for the entire visit ...
3
votes
2answers
2k views

Running declarative workflows under system account

I have an InfoPath form that starts a workflow (on item created). The business requirement is that after submission form must be read-only (no changes to the initial request can be made). However ...
3
votes
2answers
4k views

Session time out for Windows Authentication

I have a requirement where we need to timeout the SharePoint sessions (security validation). Since I am using Windows Authentication I am not able to use session timeouts (as Windows authentication ...
3
votes
1answer
28 views

How to make DIV tags accessible based on SharePoint role?

We have 3 DIV tags in master page (so, available to all pages on site). DIV 1: Employee DIV 2: Manager DIV 3: HR There are 3 groups in SharePoint:- Employee, Manager and HR. We want to make the ...
3
votes
2answers
58 views

Access Denied from Migrated SP2010 -> 2013 Web App

I've migrated a web application's content database from SP2010 to SP2013. After the migration was complete, I am completely locked out of the web application. Navigating to the root site collection ...
3
votes
2answers
2k views

Sign in as a different user access denied

Clicking the "sign in as a different user" link from the system menu in SP 2010 yields an access denied error. URL is: \_layouts\closeConnection.aspx?loginasanotheruser=true any ideas?
3
votes
3answers
1k views

SPSecurity.RunWithElevatedPrivileges that elevates outside of the current web application context

Im not sure if this is possible without impersonating a user/service account (and therefore hard coding credentials) that has farm level access... The situation is I want to access an SPSite in ...
3
votes
0answers
758 views

Opening document from Search results - This action couldn't be performed because Office doesn't recognize the command it was given

Hi I am trying to open an Office document by clicking on the search results document title, however an error box pops up saying: This action couldn't be performed because Office doesn't recognize the ...