Excel Services Permissions

Question

were setting up our SP2010 environment, and were looking to make use of excel services. Before we go all-in on excel services however, we have some causes for concern. Can anyone help define the following, or perhaps point me in the appropriate direction?

So from what I can gather, we can start excel services, give it a domain account, and assign it doc libraries to shred our excel spreadsheets... all of this works fine. Based on this:

Scenario 1.) Lets say I create a web part to display some data from an excel file, what permissions are used to determine on whether or not that web part loads? Is it based on the site displaying the web part?

Scenario 2.) Our excel files are used to expose data from our analysis services. As such, some of the files may have worksheets that arent intended for consumption for the entire business, but only some ppl within the business. What's to keep some user from typing in http//mysite/_vti_bin/excelrest.aspx/mydata/data.xlsx/model and browsing the spreadsheet for data ranges, charts, etc? Do I need to create several distinct document libraries and set the permissions on each doc library to prevent inappropriate access?

Scenario 3.) Based on the previous 2 scenario's, it would be the ultimate for me to allow a user to view excel data from a web part, but not allow them to browse the data via the excelrest.aspx services.

Answer 1

1) It is based on the permissions of the requesting user. If userA has permission to the site, but not to the document library housing the Excel file, userA will not see the spreadsheet.

2) User permissions prevent the user from using the URL to gain access. Yes, you need to create separate document libraries. Or you can set folder level permissions. Or you can set item level permissions. Regardless, you are going to need to maintain separate permission sets for each set of user access. If you don't want Joe in HR to see the Finance documents, you need to restrict Joe's access to that Excel file.

3) User permissions to the Excel file manage both. Just manage your user permissions.