11

Does anyone know of a way to implement permissions within a SharePoint list so that items are only visible to the person who created it (or potentially who the list item is "assigned to", as in like a Task) and also their manager (and their managers and so on). So any person can see all items that are either their own or belong to a subordinate?

I hope that makes sense? Any realistic way of doing this?

I'm using SharePoint Server 2010.

Thanks, James.

|improve this question
  • There are several answers below that build on each other so I'm not sure which to give as the "Correct Answer". I've voted them up for now and will see if any other solutions come along as I'm not convinced the User Profile / AD integration will be reliable enough to provide a bullet-proof solution. – j.strugnell Apr 20 '11 at 15:42
  • Most options will recommend that you break role inheritance and set permissions for individual list items via event receiver/workflow - while very valid you should be aware of the trade off - its hugely more expensive in terms of resources. – Ryan Apr 20 '11 at 16:26
4

List Item level permissions could do the trick, but when to set it? You could use a Workflow or an EventReceiver, but what happens when users get a promotion/demotion and they get a new manager?

I suggest using a TimerJob instead, which processes each item the list at a regular interval and sets the permissions by traversing the manager hierarchy from the Assigned To user up to the root by reading their User Profiles as Lori suggests.

You could throw an EventReceiver into the mix to temporarily set permissions on creation of the item just for the individual it was assigned to, so you don't expose the item to the whole organisation while we're waiting for the TimerJob to kick in.

Do consider scalability when you go down this route!

|improve this answer
  • A thorough approach indeed. I had contemplated the issue of staff movement and this could be a good solution if I was to go down the route described (e.g. traversing the User Profile manager property). – j.strugnell Apr 20 '11 at 15:38
3

Possibly an easier way than the above would be to do it in an SPItemEventReceiver attached to the list that you want this to happen on. Then using Lori's method you could look up to User Profile Service (or use System.DirectoryServices) to look up the user's manager.

|improve this answer
2

You could use a workflow to set permissions after an item is created. However, you'd have to figure out some way of looking up the user's supervisor and their supervisor and so on. This can be done using a connection to the User Profile Service. But you would need multiple connections. I haven't done that within a workflow, only within a form, but it might be a good place to start.

|improve this answer
  • Thanks Lori, I was hoping to avoid this sort of thing but it looks like it might be the only way (in combination with some of the other repsonses). – j.strugnell Apr 20 '11 at 15:32
1

Here are some ideas... not a complete solution.

For a specific list - used by a team - it is possible OOTB to have

  • team manager - view/edit all items in the list
  • each team member - only able to view their items in the list

List -> Settings -> Advanced settings

  • Read access = Only their own

+

Give Team Manager - Manage List permission => they can view / edit all items

+

Give the Manager of the Team Manager - Manage List permission (on that list)

|improve this answer
  • Hmmm... might give this some further thought. I suppose we could create separate lists for each team and then use content types to roll them up when necessary. Thanks for your contribution. I'll let you knwo if we go down this route. – j.strugnell May 11 '11 at 8:14
  • I've looked into this a bit further and I'm not sure it will meet all my needs. For example on a task list, we only want people to be able to see their own tasks. But they probably won't be creating their own tasks (i.e. their manager will). Is it possible to set up permissions on a field other than Created By? e.g. Assigned To. ? – j.strugnell May 16 '11 at 16:22
1

This is how to set permission to individual list item on SharePoint 2013

Select individual list item. Click "Share With" button on "ITEMS" ribbon menu. Click Advanced and assign a user or group.

Hope this helps!

|improve this answer
0

You will need to render the list using either a custom web part or something like a Content Query web part or XsltListViewer, configured to show only the items with appropriate ownership. I think you could also use a search web part to achieve this.

|improve this answer
  • 2
    This'd be just a filtered view, with no real permissions in place. Good, fast way if security isn't a priority and you just want to filter the view though. – James Love Apr 20 '11 at 14:46
  • 1
    Agreed - but the alternative is to set automatically set individual permissions on each item which could introduce scale problems as content grows. Question is framed in terms of visibility, not security, so could get away with this ;-) – SPDoctor♦ Apr 20 '11 at 15:31
  • Thanks. Our initial usage for this involves a Calendar. I don't really want to have to build a custom web part that recreates the Calendar view. – j.strugnell Apr 20 '11 at 15:44
  • 1
    This is security via obscurity ... which we should all know isnt security. -1 – Chris Johnson Apr 20 '11 at 19:46
  • No, this is just saying that the requirement did not include security, just the visibility of items. – SPDoctor♦ Apr 20 '11 at 22:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.