6

I am working on a sharepoint farm 2013 on-premises. and i am facing this conflict scenario which i am unable to understand. regarding the item level permissions.

  1. I have a site collection of type team site where everyone have read access.
  2. I created 2 sub-sites A & B. and they have unique permission.
  3. Now under sub-siteA i added 2 list; Custom List and Wiki pages library.
  4. Now i need to grant users from sub-siteB read permission on certain custom list items and certain wiki pages. without allowing sub-siteB members to view the other sub-siteA lists and libraries.
  5. so what i did is that i added the required custom list items and the wiki pages. For those items and pages i break their permission and i grant sub-siteB members group Read permission on the related items and pages.
  6. then i send an email containing links to these items (display form) and wiki pages (.aspx page).
  7. now sub-siteB members were able to view the wiki pages but for the list items they got the following error "Access Required". and to allow sub-siteB members to read the custom list items, i have to grant them Read permission on the list itself. unlike the wiki pages library where i was able to grant sub-siteB members Read permission on specific pages without having to grant them any permission on the wiki pages library itself.

now i did not find any documentation about these cases.. so can anyone adivce why sharepoint is treating the wiki pages and the custom list in different way when we break the permission on the item/page level as described in my above case/issue i am facing ?

Improve this question
2
  • On # 5, you broke the permissions on list items or at list level?
    – Noman Farooqi
    Commented Aug 22, 2017 at 16:53
  • @NomanFarooqi At list items level and wiki pages level.. as in my case i want subsiteB members to only access certain list items and certain wiki pages
    – John John
    Commented Aug 22, 2017 at 17:02

2 Answers 2

Reset to default
3
+25

I am guessing a bit, but, hopefully it'll help :)

Check the ULS Logs for the list item access and it should show you where the access denied was triggered, it could be that the content of the display form is triggering the access denied and not the list item itself.

Try also accessing the list item using the rest API to see if it shows the list item data or if it gets the access denied message.

Wiki pages are the displayed content itself, while the display form is just a page that shows you the content of an item. This might be why there is a slightly different behavior and some more permission needs to be granted on the list/site.

Improve this answer
5
  • Now before checking the ULS logs.. i find that when i grant user a read permission on a specific custom list item, then user will not be able to access the custom list item neither using the UI nor using the rest api .. while for the wiki pages library case, if i grant user Read permission on the wiki page level, then the user can view the wiki page using the UI (as described in my original question),, but when i try to query the page using REST API i was prompted to enter the username/password then i got this error
    – John John
    Commented Aug 24, 2017 at 14:25
  • Access denied. You do not have permission to perform this action or access this resource. here is the api call i am using which worked well for other users who have Read permission on the list /sites/cctest/n/_api/web/lists/getbytitle('wikiTest')/items/getbyid(3) .. so this seems a weird behavioure that sharepoint allow the user to view the wiki page using the UI ,, while it prevent them from viewing it using the rest api... this add another conflict to the original conflict ,
    – John John
    Commented Aug 24, 2017 at 14:28
  • on why users were able to access the wiki page using the UI ,, while they were denied the access for the custom list items..
    – John John
    Commented Aug 24, 2017 at 14:28
  • 1
    Argh, my bad :/ I'm guessing that with the rest API, since you don't have access to viewing the lists on the site, you're getting the access denied message from the /lists/getByTitle(), and not on the item. I will try to reproduce this on one of my environments and get back to you :)
    – Choggo
    Commented Aug 25, 2017 at 12:03
  • Sorry for the delay :(, just tested Was not able to reproduce... When I broke permissions on a user, he was granted limited access and was able to view the item properly, - I did use an Online environment, so maybe there's a fix? Also, do you have any custom master pages?
    – Choggo
    Commented Sep 7, 2017 at 7:31
0

Grant Item level permission for list items and grant read for entire list but once you grant item level permission for each individual list item then remove the group or users which you don't want have access to item when providing item level permission this will work as requested. I had the same issue and fixed it this way.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.