Users denied access to site, but have proper permissions

Question

I have looked through the various "similar" questions to this and haven't found a solution. Basically I have a SharePoint site that all users have access to correctly. The users can view this fine, however there are some subsites that have restricted access. Currently I am the only person who has been given access to these areas.

Example:

Main Site > Human Resources > Management Area

The Management Area is meant to be restricted, I am the only one that has the correct permissions for this site. However everyone should be able to view the HR section, which has all the same permissions as the Main Site. But everyone is getting "Access Denied" on the HR section, bar myself. They can view the Main Site fine.

Any ideas why this is happening?

PS. Also the top nav bar for some people is displaying all tabs, but some people are showing only the tabs that they have permissions to, which is what I want, how can this happen?!

EDIT: I actually have a piece of code that I am using to add a menu item to a menu if the user is able to access the Management Area.

protected void Page_Load(object sender, EventArgs e)
{
    string strUrl = SPContext.Current.Web.ServerRelativeUrl + "/ManagementArea";
    string strUser = SPContext.Current.Web.CurrentUser.LoginName;

    SPWeb ManagementWeb = SPContext.Current.Site.OpenWeb(strUrl);
    if(ManagementWeb.DoesUserHavePermissions(strUser, SPBasePermissions.ViewPages))
    {        
        System.Web.UI.WebControls.MenuItem item = new System.Web.UI.WebControls.MenuItem();
        item.Text = "Management Area";
        item.NavigateUrl = "/HumanResources/ManagementArea/";
        item.PopOutImageUrl = "/images/arrow_right_white.png";
        item.Value = item.Text;
        Menu1.Items.Add(item);
    }
}

If I remove this code the users can now access the HR section. Is there anyway to run this code for every user?

EDIT: Ok I've narrowed it down to the line:

ManagementWeb.DoesUserHavePermissions(strUser, SPBasePermissions.ViewPages)

This gives a 403 forbidden error for other users, other than me.

How do I check to see if the user has the correct permissions if this does not work?

EDIT: This is the code I used to fix it.

protected void Page_Load(object sender, EventArgs e)
{
string strUrl = SPContext.Current.Web.ServerRelativeUrl + "/ManagementArea";
string strUser = SPContext.Current.Web.CurrentUser.LoginName;
    SPWebCollection coll = SPContext.Current.Site.OpenWeb().GetSubwebsForCurrentUser();

    bool bManagementAccess = false;

    foreach(SPWeb web in coll)
    {
        if(web.Name == "ManagementArea")
            bManagementAccess = true;
    }

    if(bManagementAccess)
    {        
        System.Web.UI.WebControls.MenuItem item = new System.Web.UI.WebControls.MenuItem();
        item.Text = "Management Area";
        item.NavigateUrl = "/Insight/HumanResources/ManagementArea/";
        item.PopOutImageUrl = "/insight/images/arrow_right_white.png";
        item.Value = item.Text;
        Menu1.Items.Add(item);
    }
}

Answer 1

I had the same problem in a similar scenario (had to list all the subsites). I rewrote my web part to use SPWeb.GetSubwebsForCurrentUser Method as it only lists the sites user is allowed to open. Maybe you should first retrieve subwebs and then check if /ManagementArea is on the list.

Answer 2

Do you have anonymous access enabled for 'Management Area' subsite? What authentication model is used?

UPD:

1) You don't dispose SPWeb object either by using(..) or calling Dispose() directly

2) Run the code with SPSecurity.RunWithElevatedPrivileges to create the menu item

3) Then check if user have permissions and set item.Enabled = true

UPD2:

Or try to call ManagementWeb.CatchAccessDeniedException = false just before calling DoesUserHavePermissions

Answer 3

Pretty hard to tell what is going on in your farm with that information. But I would try to do the following:

• Make sure the "Human resources" site inherites its permission from "Main site".
• Make sure the user are assigned to the right groups
• Check the permission of a user via "Check permission" function (Can be found under: Site settings -> Site permission -> Ribbon:Edit -> Check permission

You should be able to see which user has which permission based on which group.

Answer 4

It is whole site? Sometimes user reports, that they cannot access some site and we investigate, that site contains one web part with limited rights and that is the reason why they receive Access denied error. Even CEWP with links can do this...