Is there a way to restrict, for example, an AD group access to a specific site out of the box? For example, I want to restrict access to users to Site A who are not US citizens. Is there a way OOTB or would this be done using custom solution? Any advice or links would be greatly appreciated.
SharePoint makes it easy to do as each "subsite" contains its' own permissions. In order to achieve your request, you would
break inheritance of that subsite from the parent, and only keep the groups you want.
So I don't have to write out all steps, I'm going to c/p from this source: http://www.dummies.com/how-to/content/break-inheritance-permissions-in-sharepoint-2010-t.html
To stop inheriting permissions in a subsite from a parent site, follow these steps:
Browse to the Site Permissions page for a site (choose Site Actions→Site Settings→Site Permissions).
The Site Permissions page is displayed with a message reading This Web site inherits permissions from its parent.
Click the Stop Inheriting Permissions button in the Permission Tools tab Edit group.
A message window appears reading, in part, You are about to create unique permissions for this Web site.
The Site Permissions page is displayed with a message reading, This Web Site has unique permissions.
The site’s permissions levels and SharePoint groups are no longer Read Only.
Click the Grant Permissions button on the Ribbon to grant permissions to users and groups.
The Grant Permissions dialog box appears.
In the Select Users section, enter the SharePoint Group you want to grant permissions to access the site, list, or library.
This is where you want to use your SharePoint Groups — Site Members, Site Visitors, or Site Owners. What if users are in your group that you don’t want to have permissions to the subsite, list, or library? You need to create a new SharePoint group and grant that group permission to the subsite, list, or library.
In the Grant Permissions section, select the Grant Users Permissions Directly radio button.
Select the permission level that matches the permissions you want to grant.
The default permission levels for team sites are Full Control, Design, Contribute, and Read. You can create your own permissions levels by clicking the Permission Levels button on the Ribbon if you need additional groups of permissions.
You will need to write a PowerShell script to match user's property and Add users into an AD group e.g. 'Non Citizen Group' and then assign this Group to SharePoint Site A. If the Site A is a sub-site (not site collection) you will need to break inheritance.
As far as I am aware, there is no way you can select users based on attribute for permission purposes in SharePoint.
Hope this helps.
This is a theoretical answer that I've not validated nor tested. I don't have a test environment to test this theory. Trying this on a SharePoint environment might very well break it beyond repair! So be advised.
The following theory applies only for the web application in its entirety, not sites in a web application.
Since a SharePoint Web Application is made accessible via an IIS website, it might be possible to use the IIS feature called "URL Authorization".
The URL Authorization feature offers the option to create a Deny Rule. You create a Deny rule when you want to prevent access to Web content for specific roles, groups, or users.
Steps for creating a Deny Rule in IIS:
- Open IIS Manager and navigate to the level you want to manage. For information about opening IIS Manager, see Open IIS Manager (IIS 7). For information about navigating to locations in the UI, see Navigation in IIS Manager (IIS 7).
- In Features View, double-click Authorization Rules.
- In the Actions pane, click Add Deny Rule.
In the Add Deny Authorization Rule dialog box, select one of the following types of access:
- All users, specifies that all users, whether they are anonymous or identified, can access the content.
- All anonymous users, specifies that anonymous users can access the content.
- Specified roles or user groups, specifies that only members of certain roles or user groups can access the content. Type the role or user group in the text box.
- Specified users, specifies that only certain users can access the content. Type the user ID in the text box.
Optionally, check Apply this rule to specific verbs if you want to require that the users, roles, or groups allowed to access the content can only use a specific list of HTTP verbs. Type those verbs in the text box.
- Click OK.
Again, this is something to test in a test-environment that you can afford to lose. I've not tested this in SharePoint.
More information: https://technet.microsoft.com/en-us/library/cc772441%28v=ws.10%29.aspx