1

I have JavaScript applications that use group memberships to control access to items in lists. I only want users to be able to interact with the data using these JavaScript applications. I want to prevent users from interacting with the data using out-of-the-box SharePoint GUI, such as list views.

I tried setting up users with Records Web Center Service Submitters or Restricted Interfaces for Translation, but this is insufficient. The user cannot read the data in the lists or libraries.

My current solution does this:

  • Grant the user Contribute permissions on the list.
  • Edit each public view of the list, edit the web part displaying the contents of the list, and use Target Audiences to restrict visibility of the contents of the list to those groups which should have access.

I would prefer to be able to set up a Custom Permission Level with Add Items, Edit Items, Delete Items, View Items, Use Remote Interfaces, and Open, but without View Pages. However, SharePoint automatically enables View Pages when I select any of Add Items, Edit Items, Delete Items, or View Items. Similarly, SharePoint automatically disables Add Items, Edit Items, Delete Items, and View Items when I deselect View Pages.

Is there a way to set up a Custom Permission Level as described above so that a user can use my JavaScript application to interact with the list but not have access to interact with the list using SharePoint's out-of-the-box UI?

Note: I am working in SP 2016 on-premises. If you identify a SharePoint Online solution, please provide documentation on how to adapt that solution for 2016.

6
  • 1
    How about using SharePoint App-Only Commented Jul 14, 2021 at 15:53
  • 1
    Here are few more links, Step by Step Commented Jul 14, 2021 at 15:54
  • Interesting proposal, @MatiurRahman! I will take some time to digest this and see what I can make of it.
    – Paul Rowe
    Commented Jul 14, 2021 at 16:05
  • @MatiurRahman I've tried to implement this in my on-prem 2016 setup and I can't figure out how to use JavaScript to authenticate with the client id and secret. Granted, when you posted your comments, I hadn't specified that this was SP 2016 on-prem. If you have advice on how to implement this in my environment, I'd love to hear it.
    – Paul Rowe
    Commented Jul 15, 2021 at 16:26
  • If you refer to the MS documents (the link I shared earlier), it's supported for on-prem as well. Here is a Node.js example showing how to use Client Id and Secret. Of course, there should be some version for pure JS on the internet somewhere. Commented Jul 15, 2021 at 17:49

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.