SharePoint 2013: "Sorry, this site hasn't been shared with you" After External Content Type (ECT) Data Column is Refreshed -Only affects non SC admins

Question

I am Farm Administrator and Site Collection Admin for a single site collection (the only site collection in our farm). On Prem SharePoint 2013 Server. I have created an ETC using a Secure Store ID to pass SQL Login Credentials with Read Item and Read List operations.

I have added an External Data Column using this ECT to a list in a SubSite in which there are Owners, and Members who have full Owner and Contribute permissions to edit. The owners of the subsite can do everything to edit and modify the list and can pick from the External List to populate the External Column. However if anybody other than me clicks the little refresh icon next to the external data column and then clicks OK to sync folders they are getting permission errors. In one case the "Sorry, this site hasn't been shared with you" error.

Does anybody know what other permissions are needed and where they need to be granted to allow these site owners the ability to refresh the external content via the refresh icon next to the External Column?

According to MS - they only need contribute rights, but they have that.(Bottom)

Permissions: - The users have been given the following permissions -

Secure Store Application: in Members group as AD Security Group - I also added the Web Application Pool service account as a member because otherwise I could not refresh the data.

BDC Object Permissions: They have been added via an AD Security Group with Edit, Execute, and Selectable in Clients permissions

Site Collection: No permissions

SubSite A: In Members group via AD Security Group

SubSite of SubSite A: In Owners, and Members group, also created a 3rd group with Design,Edit,Contribute,Read permissions

Any idea what I'm missing here? We are 2013 SP1

Answer 1

I found a suitable solution. In order for these site owners to be able to refresh the external data column I had to place them in the Members group of the Site Collection root. I stumbled upon this by first making them Site Collection admins, then lessening down the permissions to "Contribute"

According to the link I provided above from Microsoft: http://office.microsoft.com/en-us/sharepoint-help/create-and-update-an-external-data-column-in-a-list-or-library-HA102843647.aspx

Update an external data column

NOTE: Updating an external data column requires Contribute permission or higher on the list or library.

This statement should be modified to include "@ Site Collection level".

Because I am not inheriting permissions across all of the Sub Sites this solution works for us. I cannot find any way around this, if you do, please comment!