I am a development manager and one of the sys admin and I are trying to build a "Client Extranet", which is a fancy name for a SharePoint 2010 web application with sites that employees and clients can use together, probably just team sites.
So I understand from the sys admin that best practice is to configure SharePoint to use both Windows Auth + ASP.NET Forms Based Authentication with the FBA users being the clients. No problem, that seems straight forward enough.
However, we don't want any FBA user, aka our clients, to ever be able to see all of the other FBA users through the directory. In other words, we are concerned that an employee who is a windows user, will stick an FBA user, one of our clients, into the Administrators Group or assign a permission level that would allow that FBA user to then manage users and thus see all of the other FBA users.
Is there perhaps some event that I could handle that would allow me to put some code in that checks if an FBA user is being given a permission like "Administer the site" and stop it?