I created a site. During the process, I selected to have unique permissions and let SP create the new, default groups: Site Owners, Site Members, and Site Visitors. I created a standard list and set item level permissions to allow people to only read and edit their own items. I added my own domain login account to the owners group and User1 (another domain login) to the members group. I then created an item using my account. Next, I logged in as User1 using the site menu (sign in as a different user). I was still able to read and edit the item I created under my own account. User1 is not a member of the Site Owners group. I thought the default members group, which has contribute permissions, would adhere to the item level security setting on the list. Any ideas?
You need to understand the security structure of SharePoint. Permissions in SharePoint are inherited from Top to Bottom and not the other way around. So what is exactly Top to Bottom - The hierarchy of secured objects in a site.
Site Collection > Site > List/Libraries > Item
SharePoint supports unique permissions across any of the above. So if you have User A with Read rights at Site Collection level , all subsequent objects (Site, List and Items) under that site collection will be readable to the User A. One can stop the inheritance and provide unique access beyond the site collection level.
Coming to your problem: You have a list and items that are secured uniquely for targeted users. Now list supports two ways of filtering content in a way that the user who creates content is able to see his/her items only and not all the items in the list.
List Settings > Advanced Settings >
Modify the default view > Filter > Select Show items only when the following is true:
Created by > Is Equal to > [Me]
So, essentially security groups in SharePoint will play lesser role with Item level permissions in list if you have any of the above two approach implemented.
It turns out the problem was that the default "members" group, created by SharePoint when creating the site, has "contribute" permissions. When you look at the contribute permissions, it has "Manage Lists" checked. Item-level security ignores users with manage list permissions. I copied the Contribute permissions to a new permission level and took off the manage lists and all other things I didn't need. Then, I created a group with the new permission level and added users. Now it works.