Client Extranet with SharePoint 2010, how to prevent employees from giving clients permissions that would allow client to see all FBA users?

Question

I am a development manager and one of the sys admin and I are trying to build a "Client Extranet", which is a fancy name for a SharePoint 2010 web application with sites that employees and clients can use together, probably just team sites.

So I understand from the sys admin that best practice is to configure SharePoint to use both Windows Auth + ASP.NET Forms Based Authentication with the FBA users being the clients. No problem, that seems straight forward enough.

However, we don't want any FBA user, aka our clients, to ever be able to see all of the other FBA users through the directory. In other words, we are concerned that an employee who is a windows user, will stick an FBA user, one of our clients, into the Administrators Group or assign a permission level that would allow that FBA user to then manage users and thus see all of the other FBA users.

Is there perhaps some event that I could handle that would allow me to put some code in that checks if an FBA user is being given a permission like "Administer the site" and stop it?

Answer 1

I'm not sure if this is a Best Practice but I can tell you one solution I've seen that seems to work quite well is to break out each Client/Organization/Company into its own Site Collection under the same web application. This keeps the authentication the same, allows for the same client to access multiple sites they might have permission to and, most importantly, keeps each client/organization/Company completely isolated.

There are a few drawbacks to this approach though. The primary one being that it is not possible to do any queries that involved data in different site collections.