1

I am working on a team site collection inside our SharePoint 2013 on-premises. now under the site collection i have created a new team sub site, and i grant this sub-site unique permissions. So for example currently certain users can not view the root site, while they have Contribute on the sub-site's lists and linraries.

But i want to take things deeper regarding permission. where i want to do the following:-

  1. grant certain user contribute on a specific folder ONLY, under the team sub-site's document library.
  2. while prevent the user from viewing the root site, the sub-site's lists and the document library folder (other than the one he have contribute on)..

So is this a supported operation inside sharepoint 2013 on-premises? now based on my test ths user was able to view the folder's documents, but if he try to view the folder itself, he will get access denied error (this list has not been shared with you), and since the user can not view the folder, then he will not be able to upload document inside the folder.. so is there any workarounds ?

  • Did you try giving read rights to the library for the user? Since the user does not have rights to other folders, only the folders that are visible should appear on the library. – Deepu Nair Jul 24 '18 at 6:31
  • @DeepuNair but if i give the user Read on the Library, then he will have read on all the folders and files inside the library (since they inherit their permissions for the library)... which is not what i want to do. i want to grant him contribute on a single folder only.. so he can contribute to this folder,, but can not view any other folders... did u get my point ? – john Gu Jul 24 '18 at 10:31
2

If you give read rights on the library, I assumed that other folders in the same library had similar permissions given to separate user groups (and not having permissions inherited) making the users to see only folders they have access to.

An easy alternative would be to create another level of folder hierarchy. For example, if its Folder1 that you want to give specific access to certain users, create another Folder, say RestrictedFolder and then add the Folder1 into it. In this case, the user can see Folder1 in the library since its the parent folder "RestricedFolder" that he/she is limited to and probably the user would be able to upload files.

  • ok thanks for the suggestion.. but can i conclude that in sharepoint users can not access a folder (READ or Contribute),, unless they have permission on its parent folder ? or they should have Read on the library itself ? – john Gu Jul 25 '18 at 13:12
  • I just read through your previous comment and want to clarify one thing - Even if the user just has access to just one folder, he/she will be able to contribute to it. The option to upload files will be available for that folder. – Deepu Nair Jul 26 '18 at 1:30
  • 1
    To answer your current question, I don't think you need read rights to the entire library for a particular folder access. You should be able to create folders that are specific to certain users and groups and they would only have access to those folders. If its not important to see a folder sitting there when they click on the link, but just contribute to the folder, you wouldn't even need to have nested folders. I hope you are clear now. – Deepu Nair Jul 26 '18 at 1:36
  • but based on my test when i grant user contribute on a folder and this user does not have any permission on the library.. then the user was able to view the folder's documents (by direct access to the file such as http://servername/shareddocuments/files1.pdf), but if he try to view the folder itself or the files setting in the folder (inside the list view), he will get access denied error (this list has not been shared with you), and since the user can not view the folder, then he will not be able to upload document inside the folder, since he can not view the upload button.. – john Gu Jul 26 '18 at 14:38
  • I think its the limited access permission, which is missing here. SharePoint automatically gives limited access permission to users to the list/site when access is given to certain folders or files, enabling the users to have functions like upload or view folder settings. This is a very thin line where SharePoint starts enabling it. You can read about it here - en.share-gate.com/blog/what-is-sharepoint-limited-access . Probably how it works, depend on your SP version too. Test what works best in your conditions and be mindful to document these changes. All the best. – Deepu Nair Jul 27 '18 at 5:32
1

It depends on which kind of site collection you are using. If it is a publishing site you will have to disable the limitted access feature, otherwise the user will not be granted the limitted access permission on the site nor the library. Otherwise I am pretty sure that it is posible, but I am not sure that it sounds like a good design long term. I guess you have good reasons not to split the content in serveral libraries rather then folders

  • It is a team sub-site which dose snot have a publishing feature enabled. but it is under a site collection which have the publishing features enabled both at the site level and site collection level. but not sure if i understand your point on this If it is a publishing site you will have to disable the limitted access feature, otherwise the user will not be granted the limitted access permission on the site nor the library. – john Gu Jul 23 '18 at 18:28
  • now currently if i check the user permission on the site i can see that he is already granted limited access permission given through the "Style Resource Readers" group.. but if i ONLY assign him contribute on a folder, then the user will not be able to view the folder itself and in this case he will not be able to upload new documents through the UI.. not sure if he can upload through API or other means!! – john Gu Jul 23 '18 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.