Suas chun dáta 11/03/08: Bí cinnte a léamh ar an trácht den scoth agus mionsonraithe ó Dessie Lunsford leis an bpost seo.

Tá mé ag obair ar thionscadal eagarthóireacht rúnda tech do leabhar suas le teacht agus tagairtí sé an iontráil seo bhlag ag Tyler Butler ar an ECM MSDN bhlag. This is the first time I personally read a clear definition of the meaning of Limited Access. Here’s the meat of the definition:

I SharePoint, úsáideoirí gan ainm’ cearta atá arna chinneadh ag an leibhéal cead Teoranta Rochtain. Tá rochtain teoranta ag leibhéal cead speisialta nach féidir a shannadh d'úsáideoir nó grúpa go díreach. Is é an chúis atá sé mar má tá tú leabharlann nó subsite a briste oidhreacht ceadanna, agus a thabhairt duit úsáideora / grúpa rochtain ach amháin go leabharlann / subsite, chun féachaint a bhfuil ann, Ní mór an úsáideora / grúpa go bhfuil roinnt rochtain ar an ngréasán fhréamh. Seachas sin beidh an úsáideora / grúpa a bheith in ann brabhsáil ar an leabharlann / subsite, cé go bhfuil cearta ann, toisc go bhfuil rudaí ar an ngréasán fhréamh a bhfuil gá leo i gcóir chun an suíomh nó leabharlann. Dá bhrí sin,, nuair a thabhairt duit ceadanna grúpa amháin le subsite nó leabharlann go bhfuil briseadh oidhreacht ceadanna, Beidh SharePoint a thabhairt go huathoibríoch Rochtain Teoranta leis an ngrúpa sin nó ar an úsáideoir ar an ngréasán fhréamh.

Tagann an cheist seo suas anois agus ansin ar an fóraim MSDN agus mé i gcónaí fiosrach (ach ní aisteach go leor chun an figiúr sé amach roimh lá atá inniu ann :)).

</deireadh>

Liostáil le mo bhlag.

Lean mé ar Twitter ag http://www.twitter.com/pagalvin

I comhartha go bhfuil Ríomhaireacht Sóisialta ag tosú chun éirí de thalamh le SharePoint, I see an increased number of My Site type questions. One common question goes something like this:

"I am an administrator and I need to be able to access every My Site. How do I do that?"

The trick here is that each My Site is its own site collection. SharePoint security is normally administered at the site collection level and this trips up many a SharePoint administrator. De ghnáth, she already has access to configure security in the "main" Ní féadfar bailiúcháin suíomh agus a thuiscint go nach bhfuil an obair go huathoibríoch do Mo Láithreáin.

Bailiúcháin tSuímh cónaí le chéile taobh istigh de coimeádán níos mó, which is the web application. Farm admins can can configure security at the web app level and this is how admins can grant themselves access to any site collection in the web application. This blog entry describes one of my personal experiences with web application policies. I defined a web application policy by accident: http://paulgalvin.spaces.live.com/Blog/cns!1CC1EDB3DAA9B8AA!255.entry.

Web application policies can be dangerous and I suggest that they be used sparingly. If I were an admin (agus buíochas a ghabháil feabhas Níl mé), I would create a separate AD account named something like "SharePoint Web App Administrator" and give that one account the web application security role it needs. I would not configure this kind of thing for the regular farm admin or individual site collection admins. It will tend to hide potential problems because the web app role overrides any lower level security settings.

</deireadh>

Liostáil le mo bhlag.

Lean mé ar Twitter ag http://www.twitter.com/pagalvin

Suas chun dáta (02/29/08): Dealraíonn sé an tionscadal nua CodePlex a chur ar fáil modh chun a dhaingniú colúin aonair: http://www.codeplex.com/SPListDisplaySetting. If you have any experience working with it, fág tagairt le do thoil.

Iarraidh póstaeir Fóram minic ceist mar seo: "I have a manager view and and a staff view of a list. How do I secure the manager view so that staff can not use it?"

Siad freisin a iarraidh go minic ceist a bhaineann le: "I want to secure a specific metadata column so that only managers may edit that column while others may not even see it."

These answers apply to both WSS 3.0 agus CAONAIGH:

• Ní SharePoint a chur ar fáil as-de-an bosca-tacaíocht do thuairimí a dhaingniú.
• Ní SharePoint a chur ar fáil as-de-an bosca-tacaíocht do cholúin slándála.

There are several techniques one can follow to meet these kinds of security requirements. Here’s what I can think of:

• Use out-of-the-box item level security. Views always honor item level security configuration. Event receivers and/or workflow can automate security assignment.
• Use personal views for "privileged" tuairimí. These are easy enough to set up. Mar sin féin, due to their "personal" nádúr, these need to be configured for each user. Use standard security configuration to prevent anyone else from creating a personal view.
• Bain úsáid as sonraí páirt gréasáin dearcadh agus a chur i roinnt de chineál slándála réiteach scamhadh AJAXy.
• Roll do feidhmiúlacht taispeáint liosta féin agus a ionchorprú maidir le slándáil scamhadh ag an leibhéal colún.
• Athraigh na foirmeacha iontrála sonraí agus JavaScript a úsáid i gcomhar leis an tsamhail slándála a colún-leibhéal slándála scamhadh i bhfeidhm.
• Use an InfoPath form for data entry. Implement column-level security trimming via web service calls to SharePoint and conditionally hide fields as needed.
• Roll do ASP.NET feidhm iontráil sonraí féin go gcuireann leibhéal slándála colún scamhadh.

Níl aon cheann de na roghanna atá i ndáiríre go hiontach, ach tá ar a laghad cosán a leanúint más gá duit, fiú má tá sé deacair.

NÓTA: Má théann tú síos aon cheann de na cosáin, don’t forget about "Actions -> Open with Windows Explorer". You want to be sure that you test with that feature to make sure that it doesn’t work as a "back door" agus defeat do scéim slándála.

Má tá tú smaointe eile nó taithí le colúin a áirithiú nó a tuairimí, le do thoil ríomhphost chugam nó a fhágáil a comment agus beidh mé thabhairt cothrom le dáta seo a phost mar is cuí.

</deireadh>

Liostáil le mo bhlag.

Suas chun dáta: Phost mé an cheist seo go MSDN anseo (http://forums.microsoft.com/Forums/ShowPost.aspx?PostID=2808543&SiteID=1&mode=1) and Michael Washam of Microsoft responded with a concise answer.

Chruthaigh mé ar an ngréasán chun gníomhú mar Facade BDC-chairdiúil to a SharePoint list. When I used this from my development environment, d'oibrigh sé fíneáil. Nuair a migrated mé seo chuig freastalaí nua, Bhain mé an earráid seo:

Anseo tá líne 69:

ag baint úsáide as (Láithreán SPSite = nua SPSite("http://localhost/sandbox"))

Bhain mé triail as athruithe éagsúla ar an URL, lena n-áirítear úsáid a bhaint as an fhreastalaí ainm fíor, a seoladh IP, slaiseanna trailing ar an URL, etc. I always got that error.

Bhain mé úsáid An Google to research it. Lots of people face this issue, nó malartú uirthi, ach an chuma aon duine a bhfuil réiteach air.

Tricksy MOSS ar fáil den sórt sin earráid mionsonraithe nach raibh sé tarlú go dom a sheiceáil leis an 12 hive logs. Faoi dheireadh, faoi 24 uair an chloig tar éis mo chomhghleacaí Mhol féidir liom mar sin, Sheiceáil mé amach an 12 logáil hive agus fuair sé seo:

Eisceacht Tharla agus ag iarraidh a fháil ar an bhfeirm áitiúil:
System.Security.SecurityException: Nach dtugtar rochtain clárlann Iarrtha cheadaítear.
ag System.ThrowHelper.ThrowSecurityException(ExceptionResource acmhainn) ag
(Ainm Teaghrán, Inscríofa Boole) ag
(Ainm Teaghrán) ag
() ag
() ag
(SPFarm& feirme, Boole& isJoined)
Ba é an Crios an tionól gur theip:  MyComputer

D'oscail sé seo suas bealaí nua taighde, mar sin bhí sé ar ais go dtí an Google. A thug mé chun an fóram phost: http://forums.codecharge.com / posts.php?post_id = 67,135. That didn’t really help me but it did start making me think there was a database and/or security issue. I soldiered on and Andrew Connell ar post finally triggered the thought that I should make sure that the application pool’s identity account had appropriate access to the database. I thought it already did. Mar sin féin, Chuaigh mo chomhghleacaí agus thug an app linn snámha aitheantais cuntas rochtain iomlán a bheith SQL.

Chomh luath agus a rinne sí go bhfuil athrú, everything started working.

Cad a tharla ansin is fearr a shloinneadh mar haiku dán:

Fadhbanna a ardú a lámha.
You swing and miss. Try again.
Rath! But how? Cén fáth ar?

Ní raibh sí ag iarraidh chun rudaí a fhágáil ina n-aonar mar sin, preferring a thabhairt ar an cead íosta is gá (agus is dócha le súil a scríobh ar iontráil bhlag; Buille mé léi chun an Punch, muhahahahaha!).

Bhain sí ceadanna a chéile ón gcuntas aitheantais linn snámha app go dtí … there was no longer any explicit permission for the app pool identity account at all. The web service continued to work just fine.

We went and rebooted the servers. Everything continued to work fine.

Mar sin,, a recap: we gave the app pool identity full access and then took it away. The web service started working and never stopped working. Bizarre.

Má tá aithne ag duine ar bith cén fáth ar chóir a bheith ag obair, fág tagairt le do thoil.

</deireadh>

I needed to meet a security requirement for an InfoPath form today. In this business situation, a relatively small number of individuals are allowed to create a new InfoPath form and a much wider audience are allowed to edit it. (Is é seo an nua-cíos bhfoirm ar-dul ar bord a úsáideann Acmhainní Daonna a Seolann an sreabhadh oibre).

Chun freastal ar an cuspóir sin a, Chruthaigh mé chruthaigh dhá leibhéal nua cead ("create and update" and "update only"), broke inheritance for the form library and assigned permissions to a "create, thabhairt cothrom le dáta" user and a separate "update only" úsáideoir. The mechanics all worked, but it turned out to be a little more involving than I expected. (Má bhraitheann tú beagán shaky ar cheadanna SharePoint, seiceáil amach blog post). The required security configuration for the permission level was not the obvious set of granular permissions. To create an update-only permission level for an InfoPath form, Rinne mé an méid seo a leanas:

1. Cruthaigh leibhéal chead nua.
2. Glan ar shiúl na roghanna go léir.
3. Selected only the following from "List permissions":

• Cuir Míreanna
• Féach Míreanna
• Féach ar Leathanaigh Iarratais

Roghnú na roghanna cheadaíonn don úsáideoir chun foirm a nuashonrú, ach ní é a chruthú.

The trick was to enable the "View Application Pages". There isn’t any verbage on the permission level that indicates that’s required for update-only InfoPath forms, ach casadh amach go bhfuil sé.

Create-and-Update was even stranger. I followed the same steps, 1 trí 3 thuas. I had to specifically add a "Site Permission" rogha: "Use client integration features". Arís, Ní chuireann an cur síos ann é a dhéanamh cuma mhaith ba chóir dó a bheith ag teastáil le haghaidh foirm InfoPath, ach tá sé.

</deireadh>

Suas chun dáta 01/28/08: Tugann an tionscadal seo CodePlex an tsaincheist seo: http://www.codeplex.com/AccessChecker. I have not used it, ach tá sé gealladh fúthu má tá ceist í seo is gá duit a aghaidh a thabhairt i do thimpeallacht.

Suas chun dáta 11/13/08: Joel OLESON scríobh le post an-mhaith ar an gceist níos mó bainistíochta slándála anseo: http://www.sharepointjoel.com / Liostaí / Phoist / Post.aspx?List=0cd1a63d-183c-4fc2-8320-ba5369008acb&ID = 113. It links to a number of other useful resources.

Fóram úsáideoirí agus do chliaint a iarraidh go minic ceist feadh na línte: "How do I generate a list of all users with access to a site" or "How can I automatically alert all users with access to list about changes made to the list?"

There is no out of the box solution for this. If you think about it for a moment, nach bhfuil sé deacair a thuiscint cén fáth.

SharePoint security is very flexible. There are at least four major categories of users:

• Úsáideoirí gan ainm.
• Úsáideoirí SharePoint agus Grúpaí.
• Úsáideoirí Eolaire Gníomhach.
• Foirmeacha Fíordheimhniú Bhunaithe (FBA) úsáideoirí.

Ciallaíonn an tsolúbthacht sin ó thaobh slándála, any given SharePoint site will be dramatically different from another. In order to generate an access list report, ní mór ceann a fháil amach conas atá an suíomh faighte, query multiple different user profile repositories and then present it in a useful fashion. That’s a hard problem to solve generically.

Cén chaoi a bhfuil eagraíochtaí ag déileáil leis an? I’d love to hear from you in comments or r-phost.

</deireadh>

Suas chun dáta 12/18/07: Féach alt Paul Liebrand do roinnt iarmhairtí teicniúla a bhaint de nó a mhodhnú ainm an ghrúpa réamhshocraithe (fheiceáil a comment thíos chomh maith).

Forbhreathnú:

SharePoint security is easy to configure and manage. Mar sin féin, it has proven to be difficult for some first-time administrators to really wrap their hands around it. Not only that, I have seen some administrators come to a perfect understanding on Monday only to have lost it by Friday because they didn’t have to do any configuration in the intervening time. (Mé a admháil go bhfuil an fhadhb seo mé féin). This blog entry hopefully provides a useful SharePoint security primer and points towards some security configuration best practices.

Nóta Tábhachtach:

This description is based on out of the box SharePoint security. My personal experience is oriented around MOSS so there may be some MOSS specific stuff here, but I believe it’s accurate for WSS. I hope that anyone seeing any errors or omissions will point that out in comments or ríomhphost chugam. I’ll make corrections post haste.

Bunúsaigh:

Chun críocha an forbhreathnú seo, tá ceithre ghnéithe bunúsacha le slándáil: úsáideoirí / grúpaí, rudaí securable, leibhéil cead agus oidhreacht.

Úsáideoirí agus Grúpaí bhriseadh síos go dtí:

• Úsáideoirí aonair: Ceirteacha tarraingthe ó eolaire gníomhach nó a cruthaíodh go díreach i SharePoint.
• Grúpaí: Mapped directly from active directory or created in SharePoint. Groups are a collection of users. Groups are global in a site collection. They are never "tied" le rud securable leith.

Rudaí Securable bhriseadh síos go dtí ar a laghad,:

• Láithreáin
• Leabharlanna Doiciméad
• Míreanna aonair i liostaí agus leabharlanna doiciméad
• Fillteáin
• Suímh éagsúla BDC.

Tá rudaí eile securable, ach gheobhaidh tú an pictiúr.

Leibhéil Cead: A carn de gráinneach / low level access rights that include such things as create/read/delete entries in lists.

Oidhreachta: By default entities inherit security settings from their containing object. Sub-sites inherit permission from their parent. Document libraries inherit from their site. So on and so forth.

Baineann úsáideoirí agus grúpaí chun rudaí securable trí leibhéil cead agus oidhreacht.

Na Rialacha Slándála chuid is mó tábhachtach a thuiscint, Riamh 🙂 :

1. Tá Grúpaí simplí bailiúcháin na n-úsáideoirí.
2. Tá Grúpaí domhanda laistigh de bhailiúchán láithreán (i.e. níl aon rud den sórt sin mar ghrúpa atá sainmhínithe ag leibhéal láithreán).
3. Ainm grúpa d'ainneoin, Ní dhéanann grúpaí, i agus de féin, have any particular level of security.
4. Groups have security in the context of a specific securable object.
5. Is féidir leat leibhéil éagsúla cead a shannadh don ghrúpa céanna do gach réad securable.
6. Polasaithe iarratas Gréasáin trump seo ar fad (Féach thíos).

Is féidir le riarthóirí Slándáil caillte i farraige de ghrúpa agus liostaí úsáideoirí brath i gcónaí ar na axioms a bhainistiú agus a thuiscint a n-chumraíocht slándála.

Ceapa Tuisle Coiteann:

• Tuiscint ainmneacha Grúpa go bréagach cead: As an bosca, SharePoint defines a set of groups whose names imply an inherent level of security. Consider the group "Contributor". One unfamiliar with SharePoint security may well look at that name and assume that any member of that group can "contribute" to any site/list/library in the portal. That may be true but not because the group’s name happens to be "contributor". This is only true out of the box because the group has been provided a permission level that enables them to add/edit/delete content at the root site. Through inheritance, the "contributors" group may also add/edit/delete content at every sub-site. One can "break" the inheritance chain and change the permission level of a sub-site such that members of the so-called "Contributor" Ní féidir le grúpa cur ar chor ar bith, ach amháin a léamh (mar shampla). This would not be a good idea, ar ndóigh, ós rud é go mbeadh sé an-mearbhall.
• Ní shainmhínítear Grúpaí ag leibhéal láithreán. It’s easy to be confused by the user interface. Microsoft provides a convenient link to user/group management via every site’s "People and Groups" nasc. It’s easy to believe that when I’m at site "xyzzy" and I create a group through xyzzy’s People and Groups link that I’ve just created a group that only exists at xyzzy. That is not the case. I’ve actually created a group for the whole site collection.
• Ní tuairiscíodh ballraíocht Grúpaí athrú ag láithreán (i.e. Tá sé mar an gcéanna i ngach áit go bhfuil an grúpa a úsáidtear): Consider the group "Owner" agus dhá shuíomh, "HR" and "Logistics". It would be normal to think that two separate individuals would own those sites — an HR owner and a Logistics owner. The user interface makes it easy for a security administrator to mishandle this scenario. If I didn’t know better, D'fhéadfadh liom rochtain a fháil ar na Daoine agus naisc Grúpaí tríd an láithreán AD, select the "Owners" group and add my HR owner to that group. A month later, Logistics comes on line. I access People and Groups from the Logistics site, add pull up the "Owners" group. I see the HR owner there and remove her, thinking that I’m removing her from Owners at the Logistics site. Go deimhin, I’m removing her from the global Owners group. Hilarity ensues.
• Má theipeann ar ghrúpaí atá bunaithe ar ról sonrach ainm: The "Approvers" group is a perfect example. What can members of this group approve? Where can they approve it? Do I really want people Logistics department to be able to approve HR documents? Of course not. Always name groups based on their role within the organization. This will reduce the risk that the group is assigned an inappropriate permission level for a particular securable object. Name groups based on their intended role. In the previous HR/Logistics scenario, Ba chóir dom a chruthaigh dhá ghrúpa nua: "HR Owners" and "Logistics Owners" agus leibhéil cead ciallmhar le haghaidh gach agus an méid íosta is gá do na húsáideoirí sin a gcuid oibre a shannadh.

Tagairtí Úsáideacha Eile:

• Iarratais Gréasáin polasaí gotcha ar: http://paulgalvin.spaces.live.com/blog/cns!1CC1EDB3DAA9B8AA!255.entry
• Imréitigh do SharePoint slándála: http://www.sharepointsecurity.com/
• Naisc ó Joel OLESON: http://blogs.msdn.com/joelo/archive/2007/08/23/sharepoint-security-and-compliance-resources.aspx

Má tá tú rinne sé seo i bhfad:

Please let me know your thoughts via the comments or email me. If you know other good references, le do thoil a dhéanamh ar an céanna a!