Assign permissions to usergroup creating an item in document library

Question

I wish to create a document library to be used by a school to manage students hand-in of homework and assignments. Two groups are relevant: Students and Teachers.

The Students should be able to upload files to the library, however not edit or delete own files. In addition the students in the Students group should only be able to see their own files and not other students files.

Teachers should be able to see all Students files, edit and delete these.

I have previously managed similar requirements by workflows removing the Students permissions and granting new ones to the student and Teachers as soon as a file is uploaded. I wonder if there is a more appropriate solution?

Thx

Answer 1

Out of the box you can use enable Item Level Permission. From UI this is available only for Custom Lists. But you can enable the same on libraries using PowerShell.

This will not fully satisfy your requirements of not allowing delete.

Your best option is using Workflow. Another option is to use Event Receivers.

Answer 2

Both options require you to possible break interference and/or create custom permission groups.

Option 1. Document sets might be a viable solution for you. Here

You may also want to create an item for each student. You can then restrict their rights to read only and create so they can only see their work.

Option 2. might be to run a 2010 workflow that sets Read access to the item once it has been created for the student who created the item and teachers group read.

Answer 3

You could do this by creating a custom permission level for the Students, and granting them only Add, View and Open permissions, and not Edit or Delete.

Here is a list of all the permissions available.

An easy way to do it would be by copying the "Contributor" permission level, then going in and removing the Edit Item and Delete Item permissions on your new copy.

Then make a Students group and assign it your new custom permission level.

Teachers would get the standard "Contributor" level.

You would then probably have to break permission inheritance for the library so you can restrict access to just the Teachers and Students, and make sure that the Students aren't getting Edit or Delete permissions on the library through belonging to some other group. However, breaking permission inheritance once at the library level is far, far better than going for item-level permissions.

As far as restricting who can see what, please take a look at my answer to this other question. You can achieve what you want by using Audience Targeting on two different list view web parts that both point back to the same document library.