RoleAssigments are being assigned by default to all new pages

Question

I am pretty new to SharePoint, so please let me know if there is some more info or clarification required. I am creating a webapplication with certain SP groups, libraries and pages in that order by using a powershell script. It is creating everything properly except for one unexpected behaviour. When I look at the group permissions for an SP Group, it has access to more pages and libraries than it should. I thought that the problem occurs when I assign a group to the page but couldn't find anything too obvious. But when I debugged the solution, I found out that the roleassigments are set on the creation of the libraries and pages. Therefore, whatever groups are created, it just assigns them all to the newly created page.

Here is my code:

    #Ensure Group/User is part of site collection users beforehand and add them if needed
    $ADGroup = $web.EnsureUser("TestADGroup")

    #Get the AD Group/User in a format that PowerShell can use otherwise there will be a string error
    $ADGroupSPFriendly = $web | Get-SPUser "TestADGroup"

    #Create the SharePoint Group – Group Name, Group Owner, Group Member, Group Description. Can’t add AD group yet…
    $NewSPGroup = $web.SiteGroups.Add("TestSPGroup", $web.CurrentUser, $web.CurrentUser, "TestSPGroupDescription")
    $web.AssociatedGroups.Add($web.SiteGroups["TestSPGroup"]);
    $NewSPAccount = $web.SiteGroups["TestSPGroup"]

    #Assign the Group permission
    $GroupAssignment = New-Object Microsoft.SharePoint.SPRoleAssignment($NewSPAccount)
    $GroupRole = $web.RoleDefinitions["ReadReports"]
    $GroupAssignment.RoleDefinitionBindings.Add($GroupRole)
    $web.RoleAssignments.Add($GroupAssignment)

    #Add the AD Group/User to the group, can’t be done during group creation when using Powershell otherwise errors so is done now.
    Set-SPUser -Identity $ADGroupSPFriendly -Web $web -Group $reportLibraryRow.SPGroup


    $pubWeb =[Microsoft.SharePoint.Publishing.PublishingWeb]::GetPublishingWeb($web)

    # Create blank web part page
    $pageLayout = $pubWeb.GetAvailablePageLayouts() | Where { $_.Name -eq "BlankWebPartPage.aspx" } #you may change "BlankWebPartPage.aspx" to your custom page layout file name
    $newPage = $pubWeb.AddPublishingPage("Test.aspx", $pageLayout) #filename need end with .aspx extension
    $newPage.Title = $reportLibraryRow.PageName
    $newPage.Description = "Test page description"
    $newPage.Update()

    $pageFile = $web.GetFile("Pages/Test.aspx")
    $listitem = $pageFile.Item


    if($listitem.HasUniqueRoleAssignments -eq $false) 
    {
       [Microsoft.SharePoint.SPGroupCollection]$spgroups = $web.SiteGroups
       [Microsoft.SharePoint.SPGroup]$spgroup = $spgroups["TestGroup"]
       $sproleass=new-object Microsoft.SharePoint.SPRoleAssignment([Microsoft.SharePoint.SPPrincipal]$spgroup)
       $listitem.BreakRoleInheritance("true")
       $sproleass.RoleDefinitionBindings.Add($web.RoleDefinitions["ReadReports"])
       $listitem.RoleAssignments.Add($sproleass)
   }

   $listitem.Update()

Would be great if someone could help me figure out how to fix this permissions issue.

Answer 1

If you want to assign permissions to particular pages (think hard about this if you are going to have a lot of pages as you can run into performance issues) you need to break the permission inheritance on the page library, remove all the permissions in the library except for the Full Control/Owners group, then add your pages with your desired permissions.

If you need a lot of varying group permissions, it's better architecturally to create folders, put the special permissions on the folders and let the pages inherit the permissions. You won't run into performance issues down the road with this approach.