1

I am working on a team site collection inside our SharePoint 2013 on-premises. now under the site collection i have created a new team sub site, and i grant this sub-site unique permissions. So for example currently certain users can not view the root site, while they have Contribute on the sub-site's lists and linraries.

But i want to take things deeper regarding permission. where i want to do the following:-

  1. grant certain user contribute on a specific folder ONLY, under the team sub-site's document library.
  2. while prevent the user from viewing the root site, the sub-site's lists and the document library folder (other than the one he have contribute on)..

So is this a supported operation inside sharepoint 2013 on-premises? now based on my test ths user was able to view the folder's documents, but if he try to view the folder itself, he will get access denied error (this list has not been shared with you), and since the user can not view the folder, then he will not be able to upload document inside the folder.. so is there any workarounds ?

Improve this question
2
  • Did you try giving read rights to the library for the user? Since the user does not have rights to other folders, only the folders that are visible should appear on the library.
    – Deepu Nair
    Jul 24, 2018 at 6:31
  • @DeepuNair but if i give the user Read on the Library, then he will have read on all the folders and files inside the library (since they inherit their permissions for the library)... which is not what i want to do. i want to grant him contribute on a single folder only.. so he can contribute to this folder,, but can not view any other folders... did u get my point ?
    – John John
    Jul 24, 2018 at 10:31

2 Answers 2

Reset to default
2

If you give read rights on the library, I assumed that other folders in the same library had similar permissions given to separate user groups (and not having permissions inherited) making the users to see only folders they have access to.

An easy alternative would be to create another level of folder hierarchy. For example, if its Folder1 that you want to give specific access to certain users, create another Folder, say RestrictedFolder and then add the Folder1 into it. In this case, the user can see Folder1 in the library since its the parent folder "RestricedFolder" that he/she is limited to and probably the user would be able to upload files.

Improve this answer
5
  • ok thanks for the suggestion.. but can i conclude that in sharepoint users can not access a folder (READ or Contribute),, unless they have permission on its parent folder ? or they should have Read on the library itself ?
    – John John
    Jul 25, 2018 at 13:12
  • I just read through your previous comment and want to clarify one thing - Even if the user just has access to just one folder, he/she will be able to contribute to it. The option to upload files will be available for that folder.
    – Deepu Nair
    Jul 26, 2018 at 1:30
  • 1
    To answer your current question, I don't think you need read rights to the entire library for a particular folder access. You should be able to create folders that are specific to certain users and groups and they would only have access to those folders. If its not important to see a folder sitting there when they click on the link, but just contribute to the folder, you wouldn't even need to have nested folders. I hope you are clear now.
    – Deepu Nair
    Jul 26, 2018 at 1:36
  • but based on my test when i grant user contribute on a folder and this user does not have any permission on the library.. then the user was able to view the folder's documents (by direct access to the file such as http://servername/shareddocuments/files1.pdf), but if he try to view the folder itself or the files setting in the folder (inside the list view), he will get access denied error (this list has not been shared with you), and since the user can not view the folder, then he will not be able to upload document inside the folder, since he can not view the upload button..
    – John John
    Jul 26, 2018 at 14:38
  • I think its the limited access permission, which is missing here. SharePoint automatically gives limited access permission to users to the list/site when access is given to certain folders or files, enabling the users to have functions like upload or view folder settings. This is a very thin line where SharePoint starts enabling it. You can read about it here - en.share-gate.com/blog/what-is-sharepoint-limited-access . Probably how it works, depend on your SP version too. Test what works best in your conditions and be mindful to document these changes. All the best.
    – Deepu Nair
    Jul 27, 2018 at 5:32
1

It depends on which kind of site collection you are using. If it is a publishing site you will have to disable the limitted access feature, otherwise the user will not be granted the limitted access permission on the site nor the library. Otherwise I am pretty sure that it is posible, but I am not sure that it sounds like a good design long term. I guess you have good reasons not to split the content in serveral libraries rather then folders

Improve this answer
2
  • It is a team sub-site which dose snot have a publishing feature enabled. but it is under a site collection which have the publishing features enabled both at the site level and site collection level. but not sure if i understand your point on this If it is a publishing site you will have to disable the limitted access feature, otherwise the user will not be granted the limitted access permission on the site nor the library.
    – John John
    Jul 23, 2018 at 18:28
  • now currently if i check the user permission on the site i can see that he is already granted limited access permission given through the "Style Resource Readers" group.. but if i ONLY assign him contribute on a folder, then the user will not be able to view the folder itself and in this case he will not be able to upload new documents through the UI.. not sure if he can upload through API or other means!!
    – John John
    Jul 23, 2018 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.