Access denied when user try to use Alert Me on a list - WSS v3

Question

I have some users who have contribute access on a list and read access on the site but anytime a user tries to alert himself he gets

Error: Access Denied

Why is this? I even gave the user Full Control on the list, still the same issue!

Answer 1

I had this problem recently. In my case, a user had Contribute access to a list but at the site level had Restricted Read. Restricted Read doesn't have the Create Alerts permission. Replacing the site permissions with Read resolved the issue.

Answer 2

To expand a little on @David Clarke's sound answer, let's discuss the following three scenarios and their minimum required permissions within the Role / Permission Levels:

1. Add Own Alert

   Requires: Create Alerts

2. Manage Own Alerts

   Requires: Open Items

3. Add / Manage Alerts of Other Users

   Requires: Manage Alerts - at site level

Scenarios 1 & 2 may also require View Application Pages if not already granted via another role. Without this permission at or above the scope (site, list, item) where you want to create the Alert, you will not have the option. Furthermore, you may also be redirected to the notoriously obnoxious "Access Denied" page.

Confirmed (i.e. the same permissions exist) in SharePoint 2007 through SharePoint Online.

Answer 3

The permission to create alerts is actually at the site level. By default, I don't think the OOTB Visitors/Readers group can do this.

Answer 4

Do the site permissions allow for persnalization permissions? In the Shared Service Provider of Central Administration, do all authenticated users have personalization permissions defined in Personalization services permissions, assuming your on 2007?

Answer 5

It is a known issue, you should give the users permissions on the paren web as well, as discussed here:

You can create the alert from the list ribbon via the application page SubNew.aspx, and manage them via the MySubs.aspx page, both of them are located in the _layouts folder. The code behind class for these pages are the SubNewPage and the MySubsPage classes respectively from the assembly Microsoft.SharePoint.ApplicationPages (and the same namespace). There is no security check in the OnLoad method of the SubNewPage class (nor in its base classes), however in the OnLoad method of the MySubsPage class the CheckRights method of the LayoutsPageBase class (Microsoft.SharePoint assembly, Microsoft.SharePoint.WebControls namespace ) is called. This method checks, if the current user has DefaultLayoutsRights permission (that means SPBasePermissions.EmptyMask | SPBasePermissions.ViewFormPages | SPBasePermissions.Open | SPBasePermissions.ViewPages) on the parent web, and not on the list. If not, the user is not able to manage the alerts she created earlier.