A New Way of Seeing Things
You might think you have only two ways to implement item-level security: Undertake a significant development effort to extend SharePoint or integrate a third-party product that provides the desired level of capability. However, the simplest—and least-expensive—approach is to revise your thinking about what a SharePoint item is and what securing an item means.
A SharePoint item is more than a piece of content: It's also the SharePoint metadata (e.g., an author name, a category value) that's attached to the item, and it's the page and Web Parts that surround the item. For example, a document workspace might include the members Web Part that lists the workspace users who will collaborate on the document. Accepting this macro view of content requires that you think carefully about how to structure your information architecture.
Structure your SharePoint Portal Server areas so that content that requires similar access levels reside in the same area. Create an area security hierarchy in which permissions become more restrictive as you move deeper into the hierarchy. For example, place company-wide communications in an area to which all employees have access. Below this area, create a subarea that contains HR department data to which all HR employees have access; below that subarea, create another subarea that contains more-sensitive HR data to which only a subset of HR employees have access. For more granular control, configure permissions on Windows SharePoint Services lists and document libraries. Think of an area and a list or document library as analogous to a file-system folder, to which you assign permissions to protect the folder's content.
To make secured Windows SharePoint Services content appear in SharePoint Portal Server, use portal listings; to limit exposure to content listings, use audience targeting. An audience is a named rule or set of rules based on AD attributes (e.g., group membership) or SharePoint Portal Server profile attributes (which might or might not be mapped to AD attributes). You can use audience targeting to limit who can see a listing, by assigning that audience the ability to see the listing. You can also use audience targeting to limit who can see a Web Part. Audience targeting isn't an access-control measure. Rather, it increases the difficulty of finding a list or a Web Part for users who don't satisfy the rules assigned to the targeted audience.
Staying within the bounds of SharePoint security architecture is the easiest and cheapest approach for dealing with the item-level security gap. However, the challenge to making this approach work is staying on top of your organization's information architecture and security policies. If your organization has restrictive document-management requirements, you can integrate SharePoint with another Enterprise Content Management (ECM) product such as EMC Documentum. SharePoint provides the UI and collaboration components, and the ECM product provides, among other things, a document repository that supports item-level security. However, this approach has several disadvantages:
- The ECM product replaces, rather than augments, SharePoint's somewhat limited content-management infrastructure.
- The ECM product adds significant cost to a SharePoint implementation.
- The ECM product isn't easy to integrate into SharePoint and thus requires a dedicated resource or third party (e.g., Vorsite) to provide the integration.
- A simple upgrade path to the next version of SharePoint might not exist.
Not Perfect—but Definitely Better
As any IT professional can attest, there are no perfect software products. Every sophisticated application has some sort of shortcoming. Similarly, commercial software products can meet only a subset of the user community's needs, especially when the user base is large and diverse. Identifying gaps and proposing solutions is an essential part of assessing or working with a product. With SharePoint's increasing popularity and importance, finding and dealing with SharePoint Portal Server's and Windows SharePoint Services' gaps are vital steps in making the products succeed in your environment. For more gap-busters, see "Get Past the Gaps in SharePoint," February 2006, InstantDoc ID 48919, and look for upcoming articles on the topic. Also, let us know when you find SharePoint shortcomings, and we'll try to help you find the solutions. Send an email (with the subject line "SharePoint Gaps") explaining any gaps to Ethan Wilansky (ewilansky@windows itpro.com).
Register
