Thủ thuật Sharepoint 2010 part 34 docx

Security Groups

211
The following procedure will walk you through editing a permission level that exists on a site based
on the Team site template:

1. Follow the steps in the earlier instructions to navigate to the Permissions Level page.

2. Click the permission level you want to edit. If you select the Full Control or Limited Access
permission levels, you will notice that all of the permissions are grayed out. You will not be
able to edit these permission levels. If you select a permission level other than these two, you
can deselect current permissions and/or add permissions.

3. When fi nished, click Submit. This will save the changes you have made. Note that this change
will affect this entire site collection.
Deleting a Permission Level
In the event that you no longer wish a permission level to be available, you can remove it from the
Permission Levels page:

1. Follow the steps in the earlier instructions to navigate to the Permissions Level page.

2. Select the permission level you want to delete. For this example, the Custom Permission Level
1 will be deleted. Select this permission level and click Delete Selected Permission Levels. As
the option states, you can delete more than one permission level at a time if you so choose.

3. Once you click Delete Selected Permission
Levels, a pop-up window will appear asking
you to confi rm the deletion of the selected per-
mission level (see Figure 8-11). Click OK.

4. The selected permission level will be deleted and

will no longer be available from the Permission
Levels page.
When you delete a permission level it will no longer be available. When the
permission level is removed, any users or groups that are leveraging this permis-
sion level for access will be removed from the Site Permissions page. In order for
these users or groups to have access again, you must grant them one of the avail-
able permission levels.
SECURITY GROUPS
So far this chapter has covered the individual permissions that make up permission levels and how
these permission levels are used to grant users and groups access to SharePoint content. Now it is
time to discuss the users and groups that will be assigned the previously stated permission levels.
FIGURE 811
212

CHAPTER 8 secUriNg aNd maNagiNg site coNteNt
SharePoint Security Groups
SharePoint security groups are groups of users that are created from within the browser and can be
used within a given site collection. By default, SharePoint creates security groups (site groups) when
a new site collection is created. The groups that are created vary according to the template that is
used. The following are the site groups that may be created:
Site Collection Administrators

— This group is created for all site collection templates. It
has Full Control permissions and can do anything on this site collection. These permissions
cannot be overridden. When a new site collection is created, the creator has to specify a
value for the primary site collection administrator, and he/she will have the option to enter
a user for the secondary site collection administrator. These specified users are added to the
Site Collection Administrators group and will be able to perform the administrative tasks
associated with the site collection. These options are available from the Site Settings menu
on the top-level site collection (see Figure 8-12). These users will also be the only users

who can view the members of the Site Collection Administrators group. The Site Collection
Administrators group is also accessible from the Site Permissions page of the top-level site, as
shown in Figure 8-13.
FIGURE 812
Security Groups

213
FIGURE 813
[Site collection name] Owners

— This group is created for all site collection templates; by
default, members of this group will have Full Control.
[Site collection name] Members

— This group is created for all site collection templates; by
default, members of this group will have Contribute access.
[Site collection name] Visitors

— This group is created for all site collection templates; by
default, members of this group will have Read access.
Viewers

— This group has View Only access, and is created for Collaboration and Meeting
site templates.
Approvers

— This group has Approval access, and is created for Enterprise site templates and
Publishing site templates.
Designers


— This group has Design access, and is created for Enterprise site templates and
Publishing site templates.
Hierarchy Managers

— This group has Manage Hierarchy access, and is created for
Enterprise site templates and Publishing site templates.
Restricted Readers

— This group has Restricted Read access, and is created for Enterprise
site templates and Publishing site templates.
Configuring Permissions During Site Creation
When you create a new site, within an existing site collection, you select your template and then
you enter a name, URL, and description for your site. To configure permissions during site creation,
from the Create screen click the More Options button. The Permissions options will appear, as
shown in Figure 8-14. The default value is to Use same permissions as parent site — that is, inherit
permissions from the parent site. This means that access to the new site is the same as that used on
the parent one. No new groups will be created.
214

CHAPTER 8 secUriNg aNd maNagiNg site coNteNt
If you select Use unique permissions (as shown in Figure 8-14) and click Create, you will be prompted
to configure three new user access groups: [New site name] Owners, [New site name] Members, and
[New site name] Visitors (see Figure 8-15). This creates a customized security structure and only
users who are members of these groups will have access to the site.
FIGURE 814
FIGURE 815
Security Groups

215
The available default permissions will vary with the version of SharePoint 2010

you are running. SharePoint Foundation 2010 does not have all the same per-
missions that SharePoint Server 2010 has.
Adding a SharePoint Security Group
In addition to site groups and groups that are created when a new site is created using unique per-
missions, you can create your own SharePoint security groups, assuming you have suffi cient permis-
sions. This group will be usable within the entire site collection, not just within the site in which
it was created. When you assign a permission level to the group, that access applies to the current
securable object and all child securable objects.
This is an area where people are easily confused. When you create a SharePoint
group, you can specify the group’s permission level or you can leave it blank.
If you leave it blank, you can always confi gure the group’s access to another
securable object. If you confi gure the group’s access, the access will only be for
that securable object and any securable objects that inherit permissions from the
parent. Once the SharePoint security group is created, you can navigate to any
securable object’s permission settings page and add access for the group.
To add a SharePoint security group, follow these steps:

1. Navigate to the People and Groups page in any site within your site collection by clicking Site
Actions Site Settings.

2. Under the Users and Permission header, click People and Groups. By default, the page will
display the fi rst SharePoint group that is listed in the Current Navigation under Groups. To
see all groups within the site collection, click on the link for Groups (see Figure 8-16) to open
the All Groups page.
FIGURE 816
216

CHAPTER 8 secUriNg aNd maNagiNg site coNteNt
3. Click the New drop-down menu and select New Group, as shown in Figure 8-17.
FIGURE 817

4. Enter a name and description for the new group. For this example the name will be New
Group 1, with no description. Specify the Group Owner (only one user can be the group
owner). Typically, the only people who can view the membership of the group are the mem-
bers of that group. Additionally, only the Group Owner can edit the membership of the
group. For obvious reasons, it is not a good idea to give several users this capability. You can
also configure if and how you want to receive membership requests.

5. Click Create. Your group will now be created.
Deleting a SharePoint Security Group
Deleting a SharePoint security group is simple:

1. Navigate to the All Groups page (see steps 1 and 2 of the preceding “Adding a SharePoint
Security Group” procedure).

2. When viewing the available groups, click the Edit icon for the desired security group.

3. Scroll down and click Delete.
Managing SharePoint Security Groups in Current Navigation
To manage SharePoint security groups, follow these steps:

1. Navigate to the People and Groups page (follow steps 1 and 2 of the “Adding a SharePoint
Security Group” procedure). This procedure describes how to edit the groups displayed here.

2. Select Settings Edit Group Quick Launch, as shown in Figure 8-18.
Security Groups

217
FIGURE 818
3. Enter or remove one or more security groups from the displayed groups.
Adding Users to SharePoint Security Groups

To add users to SharePoint security groups, follow these steps:

1. Navigate to the All Groups page (follow steps 1 and 2 of the “Adding a SharePoint Security
Group” procedure).

2. Select a group by clicking on the name of the group.

3. Click the New drop-down menu and select Add Users.

4. Enter the user’s name and validate.

5. Select whether or not you want to have an e-mail sent to the user informing them of their new
access.

6. Click OK.
Deleting Users from SharePoint Security Groups
To delete users from SharePoint security groups, follow these steps:

1. Navigate to the All Groups page (follow steps 1 and 2 of the “Adding a SharePoint Security
Group” procedure).

2. Select a group by clicking on the name of the group.

3. Select the users you want to remove.

4. Click Remove Users From Group.
218

CHAPTER 8 secUriNg aNd maNagiNg site coNteNt
The two preceding procedures are for adding and deleting users, but you can

follow the same steps to add an Active Directory group to a SharePoint group.
In the people picker, specify the Active Directory group, rather than the name
of a user, and then validate the name. You can search for an Active Directory
group the same way you search for a user.
Active Directory Groups
In addition to using SharePoint security groups, you can also use Active Directory (AD) groups.
For security, you must use AD e-mail-enabled security groups. Distribution lists cannot be used. In
order for an object to be used in security it must have a Security ID (SID) in Active Directory. User
accounts have SIDs, so they can be used. Distribution lists do not have SIDs, which is why they can-
not be used as security objects in SharePoint. AD groups and individual users are granted permis-
sions in similar fashion. As such, their use is covered later in this chapter.
SharePoint Security Groups versus Active Directory Groups
Because you can use either SharePoint security groups or Active Directory groups, let’s discuss the
benefi ts and downsides to using either option. In most cases, it really depends on the environment
and the governance policy in place.
In most environments, the AD structure is much older than the SharePoint implementation and
already setup. If your SharePoint security structure needs match those of the current AD setup, then
it will be much easier to deploy AD groups, rather than recreate the same structure and add users
to SharePoint security groups. If this is not the case, and your SharePoint site structure has com-
pletely different user access confi guration needs, this is a picture-perfect example of when to choose
SharePoint security groups over AD groups.
Another thing to consider is the user who will be managing the security structure and user access. With
AD, it is almost always an information technology specialist, who may or may not have SharePoint
access. With SharePoint, the site collection administrator or site owner may be an IT professional, but
there is a good chance that it will be a manager or power user, who will not have AD access. Most
organizations avoid turning control of IT application security over to a non-IT professional. In situ-
ations where the site collection administrator and/or site owners are non-IT members, a combined
approach is common. One signifi cant drawback to AD groups is discoverability. There is no way in
SharePoint to see the members of an AD group, making it diffi cult or impossible to know who has
access to something if AD groups are used.

Special Groups and Authentication Options
There might not always be a user or group that exactly fi ts the bill when you want to add permissions
at a large level. If you need to provide access to a large group of people that is dynamic, you may need
to employ some special tactics to open your content to everyone that needs access.
All Authenticated Users

— One AD group that can be very useful is the NT AUTHORITY\
Authenticated Users group. This group represents any and all users who authenticate to your
Security Groups

219
AD domain. The advantage to using this group is that for environments that will be acces-
sible by all your domain users, this guarantees access for all your users and is easy to manage.
The downside is that this group represents all your users, granting them all access. Imagine
if this group were given access to secure content. As such, this option should be used with
caution. This also includes trusted domains, not just the domain your SharePoint servers are
in. If you are using a trusted domain for extranet users, for instance, they will all also have
access to any content secured with NT AUTHORITY\Authenticated Users.
NT AUTHORITY\Authenticated Users is an Active Directory group. Use of
this group requires Windows Integrated Security.
Anonymous Access

— This authentication method allows any user(s) to access your SharePoint
sites. Primarily seen with Internet sites, this option is useful when the users who will be access-
ing your content do not have corresponding user accounts in your domain. Anonymous Access
can only be enabled at the web application level. Once enabled, it can be available for all site
collections and sites within the web application. Since this is confi gurable at the site level, it is
up to the site collection and site administrators whether they want this enabled in their environ-
ments. Similar to using the NT AUTHORITY\Authenticate Users group, this option should
be used with caution. Anonymous access can be confi gured from the Site Permissions page, as

shown in Figures 8-19 and 8-20.
Anonymous Access can only be confi gured at the site level once it is enabled in
Central Administration in the authentication settings.
FIGURE 819
220

CHAPTER 8 secUriNg aNd maNagiNg site coNteNt
FIGURE 820
GRANTING PERMISSIONS
Giving users access can be achieved in three ways: You can grant access to SharePoint security groups,
to AD groups, or directly to users. Fortunately, the same procedure is used for each option. As previ-
ously stated, you must grant access to the specific securable object. For many environments, users will
have different access for the various sites in the SharePoint environment.
For the following procedures, you will follow the first two steps to start:

1. Navigate to the securable object. In this example, the securable object will be a site.

2. Select Site Actions Site Permissions.
Granting Access to a Top-Level Site
To grant access to a top-level site, continue with the following steps:

1. Because this is at the top-level site, you do not have to worry about inheritance. Select Site
Actions  Site Permissions.

2. Click Grant Access.

3. Enter the user name(s), AD group name, or SharePoint group name and validate.

4. When granting permissions, you can add the desired user or AD group to an existing SharePoint
group or you can give permission directly. The drop-down menu of existing SharePoint groups

also shows the corresponding permission level for each group. Adding a new entry to this
group gives that user the listed permission level. If you select Grant users permission directly,
the permission levels options will be displayed and you can select the desired access (see
Figure 8-21).