We’ve started to adopt SharePoint 2010, and are starting to manually migrate content from SharePoint 2007 sites to new sites we’re rebuilding from scratch in SP2010.
One of the things we previously had supported was to delegate responsibility for managing some of our site columns to a member of the team. The team member is not familiar with SharePoint internals, and doesn’t want the responsibility of full permissions to the site and all its objects.
We’re now trying to figure out what the minimum permission is that we need to grant our team member, so they can continue to edit (& propagate) the content of the site columns we’ve defined.
Permissions he currently has (which are obviously insufficient):
- Site permissions (according to _layouts/user.aspx): Read, Contribute, Manage Lists
- Permissions for specific objects in the site (according to _layouts/people.aspxMembershipGroupId=xxx, then choosing Settings, View Group Permissions):
-
server/sites/[sitename]: Contribute
-
server/sites/[sitename]/Lists/[a list with columns that inherit from site columns]: “Contribute No Delete”
Note: the “Contribute No Delete” permission is a custom permission I designed by copying the SharePoint-native “Contribute” permission set and deselecting the Delete permission. The “Manage Lists” permission is a custom permission I designed that includes the following specific permissions: (List Permissions) Manage Lists, View Items; (Site Permissions) View Pages, Open.
Operations that are throwing access denied errors:
- _layouts/mngfield.aspx: SharePoint returns the “Error: Access Denied” dialog, and provides three clickable options: “Sign in as a different user”, “Request access”, and “Go back to site”
- _layouts/fldedit.aspx?field=Level%5Fx0020%5F3 [one of the site columns we’ve defined]: can load the page and type in changes to the textboxes “…but when I press OK (save changes) I get the same message above.”
When our team member clicks the “Request access” link, the email I receive sends me to a page that recommends that I grant the user membership in the “[sitename] Users” group – of which he’s already a member. So while SP2010 tries to request access, it doesn’t actually direct me to either (a) a valid group that has the correct permissions or (b) the specific object to which I need to grant our team member access.
Also note: on the SP2007 (MOSS) site (where our team member was successful in managing Site Column edits), they had dozens of additional permissions throughout the site that we do not wish to blindly re-allocate in SP2010 until we know they’re necessary.
Any help anyone can provide would be greatly appreciated.
There are two sets of permissions: one set of permissions that are set at the Site level, and another set of permissions that must be assigned on every List where the Site Column is being inherited (i.e. where it’s been implemented as a List column):
Site-level Permissions
List-level Permissions
For details and the methodology on how I arrived at these permissions, you’re welcome to rad the whole gory story here: http://paranoidmike.blogspot.com/2010/10/found-minimum-permissions-to-edit-site.html