1

A specific account will upload files from many different machines all over the internet to one folder in a SharePoint library. Content of the files is sensitive in nature, so if a malicious attacker happened to obtain the credentials, that attacker should be allowed to see nothing if they were to use these credentials to connect to the SharePoint.

It is unlikely the creds would be discovered. It is also unlikely an attacker would be able to discover the URL. However it is possible. And if it is possible, then it is only a matter of time. Therefore, I'd like to limit access as much as possible.

The account should only be able to write. It has no reason to read. Other users are allowed to read. Furthermore, this account's only permission is to this site, and nothing else anywhere.

Failed Approach #1: Create a custom permission level called "Add Only":

  • Add only the "Add" permission to that level.
  • Create a group and add only that permission level to the group.
  • Add only the service account user to that group.
  • Add that group to the folder

Failed, because the "Add" permission also adds "View".

Approach #2: Programatically change the owner of the file to another user as soon as the file is uploaded with some server side code. (how?)

Am I missing something in Approach #1 which would cause it to work? How can I achieve Approach #2?

Preferably we would use standard functionality of SharePoint to achieve this. If it can only be accomplished with code, then that is probably an option.

0

You can consider using a SharePoint 2010 workflow to achieve it.

You need to install SharePoint Designer 2013 and create a workflow using SharePoint 2010 platform for the library. Then in the workflow, use "Impersonation Step" and in the step, you can use "Remove List Item Permission" or "Replace List Item Permissions" action to change the item permissions based on your requirement.

More information, please refer to:
Automating item-level permissions in SharePoint document libraries and lists

1

How about using the content organizer feature? The user will only have access to the dump library, and nothing else 😊

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.