Secret SharePoint: Why You Won’t See What You Shouldn’t - Security Trimming10 Apr 2018
One of the questions that pops up like a prairie dog on the midwestern plains is whether users will see things that they shouldn’t see. Whether it’s search or in the menus, folks don’t want others to see what they shouldn’t. That makes sense, but when does SharePoint remove these items, and when doesn’t it?
Always Means Always, Almost
The short answer is that SharePoint will always hide entries when the user shouldn’t see them. This is called security trimming. The items are returned from the query then they’re filtered – or trimmed – to only the items the user has access to. This rule applies whether the items are in a list or in search results or if the user tries to directly access the item. This even applies to menu items when those menu items are added automatically by SharePoint.
If you create a subsite called “Secret” and allow it to be added to navigation, users without permissions to “Secret” won’t see the new subsite. However, if you add the link to navigation yourself, the link won’t be security trimmed. This makes sense in a way, because the link doesn’t have the inherent security you’ve set; they can see the link, but not the “Secret” site. If users click the link, they’ll get either an access denied message or a page allowing them to request access – depending on the settings of the site.
Metadata navigation is another scenario where you might find links showing up in navigation that the users don’t have access to. Because metadata navigation doesn’t have item-level security, the users have access to all the menu items – even if they don’t have access to anything those menus lead to. That means designing pages that provide safe places to land if you’re using metadata navigation.
While the preceding facts are interesting, most people are concerned about how SharePoint makes things super searchable. All the sudden, security by obscurity isn’t a valid option. The things you’ll find once you start indexing with SharePoint can be stunning, like confidential employee information sitting out in some buried folder created by a user long since gone. The good news is that configured correctly SharePoint search will never show you something that you shouldn’t see.
When SharePoint search crawls items on your network, it picks up on the access control list that the item has. This access control list indicates who has access – and who doesn’t. SharePoint search uses this information to filter results when a user executes a query.
This is just one of the many ways that SharePoint uses to keep your data safe from prying eyes and from loss. If you need to learn more about how to set the security settings on SharePoint, check out my post Secret SharePoint: Permissions and Inheritance.
About the Author
Robert Bogue is a thought leader on all things SharePoint and an engaging presenter who speaks at events around the world. Rob has been awarded the Microsoft MVP designation fourteen times, and earned recognition as a Microsoft patterns & practices Champion. Rob holds certifications from Microsoft: MCPD, MCITP, MCTS, MCSA: Security, MCSE, as well as CompTia: A+, Network+, Server+, I-Net+, IT Project+, E-Biz+, CDIA+. Rob also served as a team member for the SharePoint Guidance. He is the author of 25 books. Robert is committed to “making the complicated, simple.” Find out more about SharePoint made simple at www.SharePointShepherd.com and follow Rob’s blog at www.ThorProjects.com/blog/. You can also contact Rob at Rob.Bogue@ThorProjects.com.