Been thinking through an interesting problem I have been presented with and I'm looking for any ideas how to approach it!
Here is the scenario
- Single Site Collection with multiple sub sites
- NT AUTHORITY\authenticated users assigned as read to the top level
visitors group in SharePoint. This means everyone has read access to any item inheriting permission from the top level
The requirement is to allow a user X to access a sub-site but not the top level site.
I'm loathe to create a group that needs to be maintained that contains all users except for user X
Thoughts I have had so far:
- Policy for Web App is a no go as it’s a single site collection
- I'm not sure if I can craft a string using the authorization in web.config to block the user X to all sites except the one sub-site they need access to
Best solution at the moment is the following:
- Remove user X from Domain Users Group
- Swap NT AUTHORITY\authenticated users with Domain Users group in SharePoint top level visitors group
- Assign unique permissions at the sub web level
Any other ideas at all would be greatly appreciated!