1

I am working on a sharepoint 2013 enterprise server. and i added a new enterprise wiki site collection to it. now i did the following inside the new site collection:-

  1. I added 4 custom lists named; Dept,Area,Category & Priority.
  2. I added 4 lookup site columns to reference the above 4 custom lists.
  3. i edit the enterprise wiki page layout and i added the 4 custom lookup columns to it.
  4. so now each wiki page can be linked to these 4 lookup columns.

and everything worked fine.

but now i am trying to implement this permission settings:-

  1. to ONLY allow Site Approvers to be able to add new items inside the 4 custom lists; Dept,Area,Category & Priority.
  2. while to allow SiteMembers to be able to add/edit/delete wiki pages.

now i am confused on how to implement this permission settings. I tried this . Approach A :-

  1. i created a new sub-site named "Admin Section", and i moved the 4 custom lists to be under this sub-site.
  2. for the "Admin Section" sub-site. i define a unique permission for it . so only Site Approvers can add/edit/delete items.
  3. but the problem i faced is that the 4 site lookup columns will not be able to reference the 4 custom lists since they are defined on a sub-site unlike the 4 site columns which are defined on the root site..

other appraoch which worked for me. Approach B:-

  1. is that for the 4 custom lists. i stop inheriting permissions and define that only Approvers can add/edit/delete.
  2. in this way no need to create a new "admin section" sub-site. and the site columns can reference the 4 custom lists.

so can anyone adivce if i should proceed with my second appraoch ? or i should avoid breaking the inheritance on list level ...

  • 1
    Approach B, you are over thinking this. – Eric Alexander Dec 7 '16 at 14:29
1

Option B is the right approach.

If you want to give them an "Admin Center" experience, create them a page with links to the various components they need to manage and secure the page in the same fashion as the lists. Then they go to a single place to manage everything (like site administrators have with Site Settings).

Based on the comments, it feels like the site permissions are not set up properly. It sounds as if you want to do a least permission mode, which would mean your site administrators should have the custom permission level as the default and normal users should have read permissions. This will give them the ability to manage the lists normally. Then in your wiki library and images library, you'd break permissions inheritance and set the desired permissions.

  • now i need to apply the unique permission on the lists themselves not only inside the "Admin Center" page, because non-admin users will be able to manually navigate to these lists , even if they can not access the "Admin Center" page... in Approach-A what i was thinking of is if we want to add extra lookup site columns in the future, then i need to add extra custom lists, and stop inheriting the permission at list level. what i was thinking in Appraoch-A is to create an admin subsite and add the lookup lists to it... – john Gu Dec 7 '16 at 16:53
  • but if i do so i will not be able to reference the custom lists inside the root lookup site columns.. if approach-A worked for me then will be managing the permission at single place the Admin sub-site.. while now i will be managing the permission based on the 4++ lists... did you get my point ? – john Gu Dec 7 '16 at 16:53
  • 1
    Then that leads me to believe your base site permissions are all wrong, if you are trying for least privilege, then you give everyone the minimum rights required and break permissions where you need to elevate permissions. So your admins should probably have this custom permission through out the site and your other users have read, and on your wiki library you break permissions and elevate them there to do what you need. – Eric Alexander Dec 7 '16 at 17:22
  • so you mean i should go the other way ... so the 4 custom lists should inherit the permission from the site , while the WikiLibrary should have the unique permission ? but if i do so then i need also to do the same for the images libraries , as any uploaded image to the any wiki page will be automatically saved inside the images folder ... – john Gu Dec 7 '16 at 18:36
  • 1
    yes, that is how i would have envisioned the permissions to be. – Eric Alexander Dec 7 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.