Limiting permissions to list-items and library files without using folders

Question

I have some files in a flat library, i.e., no subfolders, that need to have access restricted to a couple usergroups.

I understand that one way to do this is by placing items in a subfolder in the library and applying the restricted permissions to the subfolder, but I have misgivings about this method...

Namely, there are almost certainly going to be files that need to be accessed by more than one usergroup, and permitting multiple usergroups access would mean there'd be impermissible crossover in file access. Otherwise, I'd need to create and maintain two "versions" of a file, which is generally unacceptable in my design, and I know is generally strongly discouraged. Also, if you need to "folderize" files after they've already been published, the URL changes; also unacceptable.

I'm looking for alternatives.

I've had a fuzzy picture in my head of a lookup column that lists the groups at my site's level, and provides a checkbox to select which usergroups are permitted to access the file, but I don't think such a column exists OOTB, and I wouldn't have a clue where to begin in creating one.

Any ideas?

I'm working on SharePoint 2010 Foundation.

Answer 1

I understand you want to set the file / item level permission for your document library.

There is option in the SharePoint List / Libraries called item level permissions. You can set this via GUI for Lists and via PowerShell for the Libraries.

It turns out that setting Item-Level Permissions in a library is fully supported with PowerShell

The PowerShell commands for changing this are very simple:

$web = Get-SPWeb http://YourSite/
$list = $web.Lists[“Your Document Library Name”]
$list.ReadSecurity = 2
$list.Update()
$web.Dispose()

Note the 3rd line which is where you determine the value for this setting using the following values:

• 1 = “Read all items”
• 2 = “Read items that were created by the user”

If you wish to modify the values for Create and Edit access instead, replace .ReadSecurity with .WriteSecurity with the following values:

• 1 = “Create and edit All items”
• 2 = “Create items and edit items that were created by the user”
• 4 = “None”

For example:

$web = Get-SPWeb http://YourSite/
$list = $web.Lists[“Your Document Library Name”]
$list.WriteSecurity = 2
$list.Update()
$web.Dispose()

http://www.hersheytech.com/Blog/SharePoint/tabid/197/entryid/28/Default.aspx

Answer 2

If you don't plan it properly, you may soon hit Security Scope – 1,000 per list (threshold) which can cause serious performance issues. The maximum number of unique security scopes set for a list should not exceed 1,000. I would recommend reading this fine article by Martin Hatch about unique permissions.

http://www.martinhatch.com/2011/10/scaling-to-10000-unique-permissions.html

Answer 3

Rather than use folders, I create views of the document library and filter the files to display them for your various usergroups. Then, I create a SharePoint "links list" to manage access to these document library views.

For example: My flat library contains files for two usergroups. I create two views: Usergroup01.aspx and Usergroup02.aspx. Usergroup01.aspx filters for column Column01 equal to "Usergroup01" and Usergroup02.aspx filters for column Column01 equal to "Usergroup02". Note for files that need to be accessed by more than one usergroup, you can label them accordingly in Column01 and filter for them in a third view (Usergroups1and2.aspx). As your access requirements change, you can reconfigure your views and add the new or updated links to your Links List.