2

So I get why breaking inheritance copies over the limited access to sites/items from the parent site. I'm under the assumption that this process of copying over limited access is sometimes completely pointless because users may have access to one list or even list item and that is separate from the list that is getting it's inheirtance broken. So the limited access entries for the permission of that list is just noise, and has no relevance to the list permission base at hand.

Is this by design? Can someone explain why it's this way?

It is different from this thread here because I'm asking the purpose of copying limited access from the parent site to a broken inheritance list that isn't related.

For example:

Site
 List A -broken
 List B
 List C -being broken

User 1 - Access to List A

List C permissions copy over limited access from parent for access to List A, and isn't relevant to List C, isn't this just noise?

  • 1
    It appears to be just poor implementation by Microsoft frankly. – P001 Sep 27 '12 at 18:25
1

From the documentation :

You cannot assign this permission level to users or to SharePoint groups. Instead, Office SharePoint Server 2007 automatically assigns this permission level to users and to SharePoint groups when you grant them access to an object on your site that requires that they have access to a higher level object on which they do not have permissions. For example, if you grant users access to an item in a list and they do not have access to the list itself, Office SharePoint Server 2007 automatically grants them Limited Access on the list, and also on the site, if needed.

Basically, it means that something in your site has unique permissions (perhaps item or list level) and that the Limited Access users need that permission in order to be able to get to the item.

  • Please read my question more carefully. I know what a limited access entails. – Mike Aug 13 '12 at 20:51
  • If you are looking for the Process answer then I would have to assume that it is for transparency of security. By having the entry there for Limited Access, it makes it clear that those users can navigate to something in your site. Without that entry, you would not know that doman/everyone (as an example) would have any access in the site whatsoever, leading to a false sense of security. – Dave Wise Aug 13 '12 at 20:56
  • Limited Access is the permission of something on the site, but if I uninherit a list from the parent site, and it copies over the limited access, those limited access entries denote something unrelated to that list, and it's for the site. – Mike Aug 13 '12 at 21:05
  • Do any of the items in the list items have item-level security? Or does the list itself have the view permissions restricted so that people can only see the items they create? – Dave Wise Aug 13 '12 at 21:20
  • 2
    In this scenario, I would assume that it is just noise created in the process of breaking inheritance since that copies everything from the parent regardless of applicability. It could be argued that this is an oversight since Limited Access is a derived permission rather than an explicit one and thus shouldn't be blindly copied. Only MS can answer the exact 'why' of it but don't expect a quick answer from them since this is not causing a production failure nor does it appear to be a security hole – Dave Wise Aug 13 '12 at 21:51
0

Mike ... I know what you are saying/asking. We discovered the same issue. I don't think anyone has answered your question ... and probably because they don't know the answer because the question was not fully understood in the first place.

We have this same issue - even with SP 2016. Issue being - if you have 2 libraries under a site, and you break inheritance on one of the libraries, the expectation is that there is a Limited Access permission applied at the site (parent) level. As some have suggested, this is to perhaps navigate there - but this is not true because if you (as the user who now has the unique permission to the library) enter the url to the parent site you will be blocked (unless of course you already have permissions at the site level - i.e. the addition of limited access does not give you access to the site. However, what you pointed out Mike, is that not only is the Limited Access applied at the parent site, but also at all the other libraries and lists on the same level as the one where inheritance was broken!! This has stumped us too - and does not make sense, not even from a navigation pov. In fact, as the said user you can actually browse directly to those other libraries (and folders within) - but you just cannot see contents. So - from the security pov it is a risk as someone can verify a 'map' of a structure because SP actually responds to these url requests!!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.