Sharepoint Limited Access Permission

Question

So I have this group called 'Clients' which has Contribute permission to the site.

In one of the lists in the site I am breaking inheritance on list items to only allow the actual client to access that record.

This is causing that client to show up on site permissions as Limited Access, although that person is already part of the group 'Clients' which has Contribute permission.

I thought Limited Access was just designed to provide users with no access to site, just enough access so they can get to the items that have been allowed access for them.

Well this is not the case in my scenario as they are contributors, so why is SharePoint adding them to the site permissions as Limited Access?

If I look at the site permission list, it is cluttered with entries.

Answer 1

This is done because access to lower level objects require some limited access to higher level objects. Please see this post for more details. Essentially, SharePoint's internal calls to lower level objects would break without the "limited access" to higher level objects. I'm assuming that this is done at the time inheritance is broken, because it would be extremely difficult and messy to determine to only add this when needed as permissions change over time.

Answer 2

In SharePoint, anonymous users’ rights are determined by the Limited Access permission level.

Limited Access is a special permission level that cannot be assigned to a user or group directly. The reason it exists is because if you have a library or subsite that has broken permissions inheritance, and you give a user/group access to only that library/subsite, in order to view its contents, the user/group must have some access to the root web.

Otherwise the user/group will be unable to browse the library/subsite, even though they have rights there, because there are things in the root web that are needed to render the site or library.

Therefore, when you give a group permissions only to a subsite or library that is breaking permissions inheritance, SharePoint will automatically give Limited Access to that group or user on the root web.

Source: Ryan Duguid, 'Anonymous Users, Forms Pages, and the Lockdown Feature', May 11, 2007, Microsoft Enterprise Content Management (ECM) Team Blog