8

The term Permissions is used in multiple places, with different meanings

Item Level Permissions:

Set in: List Settings -> Advanced settings:

(note: you CAN set this for Libraries, not through the UI, only with code)

Item Level Security

In many blogs (like this one) this IS called Item Level PERMISSIONS

Set in: List Settinngs -> Permissions for this List

  • Break Role Inheritance on a List/Library
  • Assign (custom) Permission Profile

documentated limitations (Item Level SECURITY):

From Office Support:

Question

With List Settings->Advanced Settings->Item-Level Permissions you do NOT BREAK inheritance of permissions

  • Does using these Item Level Permissions have influence on the 50,000 threshold?

  • does this setting (ILPermission, not ILSecurity) create a "Security Scope"?

https://technet.microsoft.com/en-us/library/cc262787.aspx?f=255&MSPPError=-2147217396

says:

The maximum number of unique security scopes set for a list cannot exceed 50,000. For most farms, we recommend that you consider lowering this limit to 5,000 unique scopes. For large lists, consider using a design that uses as few unique permissions as possible. When the number of unique security scopes for a list exceeds the value of the list view threshold (set by default at 5,000 list items), additional SQL Server round trips take place when the list is viewed, which can adversely affect list view performance. A scope is the security boundary for a securable object and any of its children that do not have a separate security boundary defined. A scope contains an Access Control List (ACL), but unlike NTFS ACLs, a scope can include security principals that are specific to SharePoint Server 2013. The members of an ACL for a scope can include Windows users, user accounts other than Windows users (such as forms-based accounts), Active Directory groups, or SharePoint groups.

In my understanding

ILP is just like a View with a [Me] filter, the setting only ensures queries by a user (other then the Owner of the List) can never get/set other then his own Items.

The Item itself is not secured (the Note "Users with Cancel Checkout permissions can read and edit all item" is a clear indication)
The List (and not the Item) IS the Security Scope.

Since it its a similar concept like the [Me] filter I would assume it has nothing to do with Security or Threshold values.

  • Good question. I've never fully understood how that List Settings -> Advanced settings -> Item-level Permissions settings are implemented internally, and always thought of them like of some kind of UI trimming mechanism - like [Me] filter, as you said. I have an installation with a list that has around 20000 unique item permissions defined - should set Read access to Read item that were created by the user and see if SQL queries change. Should be able to do this week. – Aziz Kabyshev Mar 13 '16 at 16:57
  • The idea behind it is to see if additional SQL roundtrips are done when a list with unique permissions count close but less that Unique permissions limit (50000) gets ReadSecurity changed. If ReadSecurity counts against that limit, I'll get an error, right? Also there are some potentially useful SQL queries at reality-tech.com/… – Aziz Kabyshev Mar 13 '16 at 17:08
  • Cool, I am on Office365 SharePoint Online so can't tinker like I did many moons ago... – Danny '365CSI' Engelman Mar 13 '16 at 19:45
  • I agree it is not a security thing but a list setting. This can also be seen by copying/moving the list item to an other list with Read all items option checked. I don't know how this 'security' trimming is integrated into search... Maybe it a security setting on list level so it's also applied in search result security trimming. – Suleyman May 31 '16 at 9:06
1

I'm not quite sure about your understanding. So i make a test scenario

For 2nd question, I assume "Security Scope" means record in table "Perms" of content database. I've studied SharePoint content database in long time so I'm sure each broken permission (item, web, list, etc.) corresponds with 1 record in "Perms" table. And the number of records in "Perms" table isn't changed when I change List Settings -> Advanced settings -> Item-level Permissions settings.

For 1st question, based on answer of 2nd question, I think List Settings -> Advanced settings -> Item-level Permissions settings does NOT have any impact to Unique Item Permission threshold. But for sure, I have created 50,000 items in one list and broke permission for all of them. After that, i created 1 more item and I saw that List Settings -> Advanced settings -> Item-level Permissions settings does not depend to "50001st item cannot be broken permission". The exception message is "You cannot break inheritance for this item because there are too many items with unique permissions in this list.".

I agree with you about List Settings -> Advanced settings -> Item-level Permissions settings, it's only list setting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.