A specific account will upload files from many different machines all over the internet to one folder in a SharePoint library. Content of the files is sensitive in nature, so if a malicious attacker happened to obtain the credentials, that attacker should be allowed to see nothing if they were to use these credentials to connect to the SharePoint.
It is unlikely the creds would be discovered. It is also unlikely an attacker would be able to discover the URL. However it is possible. And if it is possible, then it is only a matter of time. Therefore, I'd like to limit access as much as possible.
The account should only be able to write. It has no reason to read. Other users are allowed to read. Furthermore, this account's only permission is to this site, and nothing else anywhere.
Failed Approach #1: Create a custom permission level called "Add Only":
- Add only the "Add" permission to that level.
- Create a group and add only that permission level to the group.
- Add only the service account user to that group.
- Add that group to the folder
Failed, because the "Add" permission also adds "View".
Approach #2: Programatically change the owner of the file to another user as soon as the file is uploaded with some server side code. (how?)
Am I missing something in Approach #1 which would cause it to work? How can I achieve Approach #2?
Preferably we would use standard functionality of SharePoint to achieve this. If it can only be accomplished with code, then that is probably an option.
