6

I have a team site collection, and i grant users the following permission "Restricted Interfaces for Translation" but seems users can not view the site and its lists, and they will get the following error "this site has not been shared with you". so can anyone adivce what is the purpose for the "Restricted Interfaces for Translation" permission? as seems it will not have any effect for the users, and users with "Restricted Interfaces for Translation" permission will be similar to users who have no permission at all.. is this correct? now inside the permission level description, i found the following:-

Can open lists and folders, and use remote interfaces.

so this is the trick , what does open list and folders mean? and what does use remote interfaces mean? could this mean that users with "Restricted Interfaces for Translation" can still view the list items using the list api ??

Improve this question

2 Answers 2

Reset to default
5
+25

I use that 'restricted interfaces for translation' when I have people who have contribute rights to a list in a site, but don't have any rights to the site itself.

In 2010, giving a person contribute rights to a list, gave them 'limited access' to a site (SharePoint did that automatically). They had no trouble contributing to the list.

In 2013, that same setup gave users a 'waiting for... cannot update' error message when they tried to contribute to a list. Not sure if it was an artifact of our upgrade from 2010 to 2013, but it was a consistent error. The only way I could get around that was to use the 'restricted interfaces for translation' at the site level. (This is assuming you don't want to give these people read access to the site).

I've found that 'open' doesn't really give them access to a list - they might be able to see it exists (for example, on the left nav or in the site contents page), but they can't see any items unless they have specific permissions. It's more for SharePoint to be able to traverse paths to get somewhere.

Improve this answer
7
  • Wooow this is exactly the case i am facing on multiple 2013 farms (which were born as 2013 not migrated from 2010). where i granted users contribute permission on a specific list inside a site, and without granting them any permission on the site itself. now those users were able to view the list item, access the edit/create list forms, but when they click on save they will get the following error "The server was unable to save the form at this time. Please try again.".. and to fix this i had to grant them 'restricted interfaces for translation' on the site..
    – John John
    Aug 17, 2017 at 17:06
  • so i asked this question to know what are the risks of granting users 'restricted interfaces for translation' on a site? now based on my test the users can not view any of the list items using sharepoint UI, and I also try to check if they can get the list items using the list REST API and seems they can not.. but i am still not 100% sure if the 'restricted interfaces for translation' will allow the users to view the list items in a way or another?or using a workaround?.. can not find any documentations about this case?
    – John John
    Aug 17, 2017 at 17:09
  • now the secret is what does "Can open lists and folders, and use remote interfaces." allow them to do ?
    – John John
    Aug 17, 2017 at 17:09
  • 1
    I've never found any specific documentation, just tested as you did. We couldn't find any workarounds. One thing we didn't try was to show any other lists via Access. But I'm doubting that would work - I don't think opening lists/folders (which are really the 'structures', not the data) will give them access - though maybe through REST they could get the list structure? That would give someone information that data exists... It was critical in our case so I stopped investigating.
    – Robin in Or
    Aug 17, 2017 at 18:55
  • 1
    I just meant there are levels of security you can accept - the actual items in the list being invisible, or the actual structure of the list and the column names. One of our lists we didn't even want anyone to see the list column names so they would know what kind of data was being recorded. I was uncomfortable with this during our 2010->2013 migration, so we decided to move this to a separate site so we could easily control the security without unintended consequences (if something changed during an upgrade for example.)
    – Robin in Or
    Aug 21, 2017 at 14:25
2

There is lack of in-depth documentation about "Restricted Interfaces for Translation" permission. You need to give two kinds of permissions in order to access specific list with no access to your subsite.

  1. Give "Restricted Interfaces for Translation" to user/group permissions on subsite.

  2. Stop inheriting permissions on your list and give unique permissions with "Contribute" permission to user/group.

Query 1: what does open list and folders mean?

"Open permission" inside "Restricted Interfaces for Translation" says that it allows users to open a Web site, list, or folder in order to access items inside that container. That means, first of all you need to give "Restricted Interfaces for Translation" permission on subsite in order to access the list items& then "Contribute" permission on list will actually allow you to access the items.

If you will give only "Contribute" permission to user/group on list without "Restricted Interfaces for Translation" permission on subsite, Then you will get "Unable to communicate with server" error while updating the item & "Access denied. You do not have permission to perform this action or access this resource." error while ading the item.

Query 2: what does use remote interfaces mean? could this mean that users with "Restricted Interfaces for Translation" can still view the list items using the list api

REST API, Web Services, Client Object Model Application (Windows applications), SharePoint designer these are remote interfaces which allows user to access sharepoint resources remotely.

"Restricted Interfaces for Translation" on site doesn't allow users to access items from all lists/libraries. But User can able to view all lists/libraries properties by remote interface (like REST API, Web Services).

For verification, I entered below rest url on browser and checked (First give above mentioned permissions on sub site and your list & try below api on another list on which user has not any permissions)

SiteUrl/_api/web/lists/getByTitle('List Name of no user permission')

above api will give you list properties.

SiteUrl/_api/web/lists/getByTitle('List Name of no user permission')/items

above api will not give any response of items.

Now regarding to sharepoint designer, SPD doesn't allow user to open site/list in designer who having only Restricted Interfaces for Translation permissions .

So, as per my experience, Only "Restricted Interfaces for Translation" permissions on site doesn't allow user to access all lists & list items. For accessing the list items user also needs "Contribute" permissions on list.

Improve this answer
10
  • 1
    Exactly. Only RIFT permission doesn't allow user to add/update any list/list items. It also needs contribute access on that specific resource.
    – SP Developer
    Aug 19, 2017 at 3:58
  • 1
    RIFT doesn't allow to view list items. it will only expose list properties. For Verification, i have checked by using REST API & its doesn't give any response about list items for RIFT users.
    – SP Developer
    Aug 21, 2017 at 14:21
  • 1
    I have also checked by Client side object model (JSOM) which is also one one remote interface and as we discussed it also does not allow to view list items to RIFT users. As per my knowledge there are only REST,Web Service,CSOM, SP Designer remote interfaces can be used in SharePoint & we have checked all above. If the core sharepoint remote interfaces not giving any chance to view list items then NO other interfaces (if available) can able to view.
    – SP Developer
    Aug 21, 2017 at 14:39
  • 1
    I know the description of the RIFT permission level is confusing & its always forces us to rethink on it again & again. Prior to your question I have personally I did lots of analysis on it & based on that I gave above answer. But now a days, even any smallest compromise with security is risky. I suggest you to generate MS Support ticket or ask question on Microsoft forum. it's better to get help from Microsoft support experts.
    – SP Developer
    Aug 21, 2017 at 15:40
  • 1
    In our organization, I have granted RIFT permissions to 3 users . & users not able to see other list items including remote interfaces. so personally i'm comfortable with this permission. But before granting this permission i did not communicated with any MS experts, i did my own R&D & then granted this permissions & That's why i told you , if you have any doubt or feel discomfort then get more help from MS experts :-)
    – SP Developer
    Aug 22, 2017 at 13:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.