3

I have a custom list on a SharePoint 2010 extranet site which users from various external companies can add items to. The list's Permission Settings page allows you to make all items visible to all users, or make items visible only to their author however I need to limit the visibility of the list items to the person that created the item AND everyone else in their company too.

The company name is stored in Active Directory along with the user account.

Is it possible to achieve this programmatically, and if so, how?

FYI: New users will continue to be added to Active Directory long after the solution has been deployed (potentially from new companies) so I'd need a solution that accounts for that.

FYI: I don't want to create a seperate list for each company because there will be a large number of users and companies.

[UPDATE] Here's a simple example... Let's say Bill Gates and Steve Jobs have both previously added items to my list. Well I want all employees from Apple to be able to see & edit only Steve Job's items when they navigate to my list, and similarly, all employees from Microsoft to see & edit only Bill Gates' items.

Improve this question

2 Answers 2

Reset to default
1

Depending on the wider picture of you requirement, you can separate the author's input into several folders/library/subweb.

Using several library or subweb (one for each company), you can set up once for each company the permissions (at the library or subweb level).

For your own company users, either a content query web part with site collection query of a specific content or use a flat view if you store everything in the same library with specific folder.

It will be far more simple to implement than having to programmaticaly set permissions for each elements.

[Edit] As I misread the question, the following answer is not valid anymore. I keep it for information.

You can set the SecurityBits attributes to 22 of the ListTemplate element. Grant the users of your company the ManageList permission to see everything in the list.

However, as stated in the documentation, it does not applies to Document Libraries.

I thinks this solution is quite simple, if you can use a custom list template.

[Edit] You can also set up this behavior in the advanced settings page of the list for existing lists.

Improve this answer
3
  • Hi Steve, setting the SecurityBits property to 22 will cause this behaviour: "Users can read only their own items" and "Users can edit only their own items". If you read my question again you'll see that I need the people from every author's company to be able to read & edit that author's items. Please see the example I just added to the original question.
    – user4545
    Commented Jan 20, 2012 at 3:17
  • You are right, I misread the question. Let me update my answer
    – Steve B
    Commented Jan 20, 2012 at 8:25
  • 1
    I ended up creating a unique folder for each company and a SharePoint group containing the users from each company too. I then granted "contribute" permissions on each folder to its corresponding group only (this prevents people from "Company A" seeing or accessing the "Company B" folder and vice versa). The only extra bit of dev required here was to create an event receiver which displayed an error page whern users tried to add items tothe very root of the list.
    – user4545
    Commented Jun 13, 2012 at 1:54
3

Yes, Nick, it's possible. You can add event receiver to list and override item added event. Using this way you can code any your logic. I need warn you about possible performance problem with uniqe permissions of each item. If you don't wory about performance problems (for example, where isn't a lot of items or users), then you can use event receivers. If you wory about performance, then you might think about creating lists or folders for each company.

MSDN: Using Event Receivers in SharePoint Foundation 2010

Sample Event Handler to set Permissions

Improve this answer
2
  • I've already got an event receiver setup on my list (it manually kicks off some workflows when new items are added) so I know how these work. I'm really looking for some specifics as to what code I'll need inside my ItemAdded event. Could you show me how to programmatically set permissions on a list item to achieve the "show this to me and anyone from my company" requirement?
    – user4545
    Commented Jan 19, 2012 at 8:42
  • Nick, you have to query active directory. If AD users belongs to specific company group, you need only take current user groups, choice company group (if it possible) and assign same as current user permissions for this AD group. Unfortunaly, i'm not have code example. You can view some same code at this post: willasrari.com/blog/query-active-directory-users-using-c/… . If your users don't belong to company groups, then you have query all users in AD with same as current user company atribute value and assign permissions to each user. It's performance gap.
    – IAfanasov
    Commented Jan 19, 2012 at 11:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.