5使用细化权限的最佳实践白皮书SharePoint Server.docx
- 文档编号:4688944
- 上传时间:2022-12-07
- 格式:DOCX
- 页数:18
- 大小:1MB
5使用细化权限的最佳实践白皮书SharePoint Server.docx
《5使用细化权限的最佳实践白皮书SharePoint Server.docx》由会员分享,可在线阅读,更多相关《5使用细化权限的最佳实践白皮书SharePoint Server.docx(18页珍藏版)》请在冰豆网上搜索。
5使用细化权限的最佳实践白皮书SharePointServer
Bestpracticesforusingfine-grainedpermissions
Thisdocumentisprovided"as-is".Informationandviewsexpressedinthisdocument,includingURLandotherInternetWebsitereferences,maychangewithoutnotice.Youbeartheriskofusingit.
Someexamplesdepictedhereinareprovidedforillustrationonlyandarefictitious.Norealassociationorconnectionisintendedorshouldbeinferred.
ThisdocumentdoesnotprovideyouwithanylegalrightstoanyintellectualpropertyinanyMicrosoftproduct.Youmaycopyandusethisdocumentforyourinternal,referencepurposes.
©2010MicrosoftCorporation.Allrightsreserved.
Bestpracticesforusingfine-grainedpermissions
Writer:
SeanLivingston,ProductManager,SharePointProductGroup
Published:
September2010
Summary:
Thispaperdescribesbestpracticesforfine-grainedpermissions(FGP)andhowtousethemwithinyourorganizationwhenusingSharePoint®ProductsandTechnologiesorMicrosoft®SharePoint®2010Products.
Contents
Contents3
Overviewofusingfine-grainedpermissions4
SharePointpermissionsystemoverview5
Permissionlevels5
SharePointgroups5
Scope5
Securableobject6
Inheritance6
Limitedaccess7
BinaryACL8
BestpracticesforavoidingcommonFGPlimitissues9
Toomanyscopeswithinalist9
Toomanymemberswithinascope10
Verydeepscopehierarchy10
RecommendedsolutionsforcommonFGPperformanceissues11
Solution1:
RemoveFGPandusesecurityenforcementonlyatWeblevel11
Environmentalsecuritycleanup11
Environmentalsecurityarchitectureredesign12
Solution2:
Usefine-grainedpermissionsbyhierarchicalstructurechanges13
Environmenthierarchyredesign13
Solution3:
Usefine-grainedpermissionsbyscopestructurechanges(2010only)14
Dynamicsecuritychangingcoderedesign14
Environmentarchitectureexample15
Environmentoverview15
Workflowdesign16
Fine-grainedpermissionissues17
ResolutionofFGPissues18
Summary20
Overviewofusingfine-grainedpermissions
Thisarticledescribestheuseoffine-grainedpermissions(FGP)forSharePoint®2010Products(Microsoft®SharePoint®Server2010andMicrosoft®SharePoint®Foundation2010)andSharePoint®ProductsandTechnologies(OfficeSharePoint®Server2007andWindowsSharePoint®Servicesversion3.0);performanceissuesrelatedtoFGP;andbestpracticesforconfiguringsolutionsthatincludeFGP.
Note:
WerecommendthatyouuseFGPforonlythosebusinesscasesforwhichitisrequired.FGPcanbeexpensiveintermsofbothoperationaloversightandperformance.
YoucanavoidtheuseofFGPbydoingthefollowing:
∙Breakpermissioninheritanceasinfrequentlyaspossible.
∙Usegroupsbasedondirectorymembershiptoassignpermissions.
Note:
WedonotrecommendthatyouuseSharePointgroupstoassignpermissionstosites,becausewhenaSharePointgroupisusedtoassignpermissions,afullcrawloftheindexoccurs.Instead,werecommendDomaingroupstobeused.
∙Assignpermissionsatthehighestpossiblelevel.Aspartofthisstrategy,considerthefollowingtechniques:
oSegregatedocumentsthatrequirefine-grainedpermissionsintodocumentlibrariesthataredefinedtosupporteachgroupofpermissions,andkeepthedocumentlibrariesinasegregatedsitecollectionorsite.Foradditionalinformationabouthierarchicalchanges,seeSolution2:
Usefine-grainedpermissionsbyhierarchicalstructurechanges.
Note:
Inthisdocument,thetermsWebandsiteequatetotheSPWebobject,andsitecollectionsequatetotheSPSiteobject.
oUsedifferentdocumentpublishlevelstocontrolaccess.Beforeadocumentispublished,theadvancedpermissionsandversioningsettingscanbesetforuserswhocanonlyapproveitemsinthedocumentlibrary.
oFornon-documentlibraries(lists),usetheReadSecurityandWriteSecuritypermissionlevels.Whenalistiscreated,theownerscansettheItem-levelpermissionstoeitherReadaccessorCreateandEditaccess.
Ifyoumustusefine-grainedpermissions,considerthefollowingrecommendedpractices:
∙Ensurethatyoudonothavetoomanyitemsatthesamelevelofhierarchyinthedocumentlibraries,becausethetimenecessarytoprocessitemsintheviewsincreases.
∙Useeventhandlerstocontroleditpermission.YoucanhaveaneventhandlerthatregistersaneventusingtheSPEventReceiverType.ItemUpdatingandSPEventReceiverType.ItemUpdatedmethods,andthenusecodetocontrolwhethertheupdateshouldbeallowed.Thisisextremelypowerful,becauseyoucanmakesecuritydecisionbasedonanymetadataofalistoritem,withoutaffectingtheviewrenderingperformance.Foradditionalinformationabouteventhandlers,seeResolutionofFGPissues.
∙UseAddToCurrentScopeOnlymethodtoassignLimitedAccessmembershipwithinaSharePointgroup.ThekeyelementinthisprincipleistoredesignthearchitecturesothatscopemembershipdoesnotcauseACLrecalculationattheparentdocumentlibraryandWeb.Foradditionalinformationaboutscopechanges,Solution3:
Usefine-grainedpermissionsbyscopestructurechanges(2010only).
SharePointpermissionsystemoverview
ThissectiondescribestheSharePointpermissionsscopesystem.Formoreinformationaboutplanningsitesecurity,see:
∙Plansitepermissions(SharePointServer2010)(
∙Plansitepermissions(SharePointFoundation2010)(
∙Plansitesecurity(OfficeSharePointServer)(
∙Plansitesecurity(WindowsSharePointServices)(
Permissionlevels
Apermissionlevelcontainsasetofindividualpermissions,forexample,ViewItemsorCreateAlerts.Permissionlevelscanbepredefinedorcreatedbytheuser.Thesetofpermissionscanbemodifiedevenwithinthepredefinedpermissionlevels.
SharePointgroups
ASharePointgroupisasitecollection-wideobjectthatcanholdothersecurityprincipals,includingWindowsuseraccounts,non-Windowsusers(forexample,forms-basedaccounts),andActiveDirectorygroups.
Scope
Ascopeisthesecurityboundaryforasecurableobjectandanyofitschildrenthatdonothaveaseparatesecurityboundarydefined.ThescopecontainsanAccessControlList(ACL),butunlikeNTFSACLs,ascopecanincludeSharePoint-specificsecurityprincipals.ThemembersofanACLforascopecanincludeWindowsusers,non-Windowsusers(suchasforms-basedaccountsinSharePointProductsandTechnologiesorclaims-basedaccountsinSharePoint2010Products),ActiveDirectorygroups,orSharePointgroups.
Thereisnomaximumnumberofscopesthatcanbecreatedwithinaparentscope.However,inSharePointProductsandTechnologies,after1,000scopeshavebeencreated,acodepaththatrequiresadditionalMicrosoft®SQLServerroundtripstoanalyzethescopesbeforerenderingaviewisused.Whenthere1,000orfewerscopes,onlyoneroundtripisrequired.InSharePoint2010Products,thelimitofnumberofscopesreturnedbeforeswitchingtoadifferentalgorithmisbasedonaquerythrottlelimit,withadefaultvalueof5,000;howeverthisvalueevenatdefaultcanbelargeenoughtosignificantlydetractfromperformance.
InSharePoint2010Products,thereisanewmethodcalledSPRoleAssignmentCollection.AddToCurrentScopeOnly,bywhichroleassignmentcanoccur.Foradditionalinforamationaboutroleassignments,seeSPRoleAssignmentCollection.AddToCurrentScopeOnly(
Securableobject
AsecurableobjectisanobjectthatcanhaveanACLassignedtoit.InSharePointProductsandTechnologies,theISecurableObjectinterfacecanbeused,andinSharePoint2010Products,theSPSecurableObjectclassshouldbeused.Foradditionalinformationaboutsecurableobjects,seeISecurableObjectinterface(orSPSecurableObjectclass(
Inheritance
Ifasecurableobjectdoesnothaveauniquescope,theobjectinheritsthescopeofitsparent.Whenanobjectinheritsfromitsparent,noscopeiscreatedfortheobject.Instead,wheneverasecuritycheckismade,itverifiesonlyagainsttheparentobject.Inthesimplestenvironment,thisscopeisattherootWebofthesitecollectionthatcontainstheitem.Whenanitemorcontainerischangedtohaveuniquemembership,itsinheritanceisbroken,whichmeansthatanewscopeiscreatedforthatitemand,bydefault,foranyofitschildrenthatinherititspermissionscopes.
Thefollowingdiagramshowsanobjecthierarchyforadocumentlibrary,inwhichallobjectsbutoneinherittheirscopefromtheirparents.Eachnumberedgoldhexagonrepresentsapermissionsscope.Allchildobjectswithinacontainerinheritfromthatparentscopeunlesstheyhavetheirownuniquepermissionsscope.
Limitedaccess
Whenasecurityprincipalisaddedtothescopeofanitemwithuniquepermissions,thesecurityprincipalisimmediatelyaddedwiththeLimitedAccesspermissionleveltoeachuniquepermissionscopeinthehierarchyabovetheitemuntilaparentWebwithuniquepermissionsislocated.
ThereasonforaddingtheusertothescopeswithLimitedAccessistoallowenoughaccesstotheobjecthierarchicallyabovetheuniquelypermissioneditemsothattheObjectModel(OM),masterpages,andnavigationcanrenderwhentheuserattemptstonavigatetothei
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- 5使用细化权限的最佳实践白皮书SharePoint Server 使用 细化 权限 最佳 实践 白皮书 SharePoint
![提示](https://static.bdocx.com/images/bang_tan.gif)