[Moss Development]: WSS V3 authorization

As we all know, MossIs Applied inWSSBased on,AllMossDevelopment is inevitableWSSTo learn more,Proficient, of course, is the best. HereB/SPermissions are an important part of the architecture software.MossIs also true. InMoss.WSSTo process permissions.Security authorization management consists of the following security elements:

Security element name	What do you have?
User	Permission
Domain group	Permission level
SharePointGroup	Security object

 

Security element Relationship DiagramAs follows:

Security element member definition:

1:User: any user with a user account can be directly grantedWSS v3Access to a security object. It is the most basic and necessary element of the security element. When defining a site, a site owner is created, and the site owner is a user.

2:Domain group: it can be a Microsoft Active Directory Security group or a custom system-defined group.

3: SharePointGROUP: it is a global definition of a site. It is created on the site set layer and can be used by any site. It is the highest level of a security object and contains both users and domain group objects.WSS v3Comes with three default valuesSharePointGroup, which are:

SharePoint group name:	Permission level
Owner	Full Control)
Member	Contribute)
Visitor	Read (read-only)

 

Permission management:If it is a user identity, you must set it separately. This kind of user should not be too many, it is best to avoid completely avoiding it, because once there are too many such users, it takes a lot of effort to allocate permissions to them. In this case, the solution is to divide these user groups into one group, and all group members have the same permissions assigned to the Group to reduce repetitive workload. WhileSharePointGroup-based permission management is much easier than managing permissions through domain groups or individual users. It can combine domain groups with individual users.WSS v3You can set special permissions for site sets, sites, lists, folders, etc. By default, each object inherits permissions from its parent object,WSS v3Security object level diagramAs follows:

 

 

Security Element Object relationship diagramAs shown in, each security object has a level, which can be used to inherit the permissions of any parent object as sub-objects, you can also specify specific permissions for an object without having to consider parent-level permissions. The level relationship is not the most comprehensive, but it simply lists several layers of relationships. Generally, a level may be extended to more layers. As mentioned above, permission inheritance also allows us to prohibit permission inheritance for an object. In this case, the security object does not inherit permissions from the parent object, but has its own special permissions.

What are permission levels and permissions?

These two names both seem similar, so that users or domain groups have the corresponding permissions,WSS v3Control the actions that each user and group can perform on security objects through permission levels and permissions. However, they are essentially different: the permission level is defined by a group of permissions, and each permission level is associated with multiple write permissions. These permissions include:

Permission Name:	Function:
Full Control	Including all permissions, allowing users to execute anyAction, it cannot be changed or deleted
Design	Editing
Distribution	View and edit functions
Read	View Functions
Restricted access	When a user or a group has access permissions, the user can access the object but cannot access the parent object. This is automatically assigned and cannot be set or modified.

 

Each permission level is composed of Multiple permissions. These permissions are listed as follows,Website and personal permission categories constitute each permission Group, As shown in:

 

 

Management permissions:WSS v3Permission management consists of three parts:

1:Users and groups;

2:Security object;

3:Permission level and permission.

Manage permission structureAs follows:

 

1. Select the default permission level, group, or custom permission level;

Second, add users andSharePointGroup, and assign the permissions defined in step 1 to the group users and domain groups.

Third: if the object requires special permissions, you do not have to worry about the parent-level permissions, but it is best to avoid this method.

WSS v3Namespace used by security objects inAs follows:

Miscrosoft. Sharepoint. sproleassignment

Miscrosoft. Sharepoint. sproleassignmentcollection

Miscrosoft. Sharepoint. definitioncollection

Miscrosoft. Sharepoint. Definition

Miscrosoft. Sharepoint. spbasepermissions

Miscrosoft. Sharepoint. sproledefinitionbindingcollection

Security element encoding:

1: Permission level:The permission level is the permission naming set defined within the scope of the website. You can use the WSS object model or the WSS Management page accessible to the website set owner to create your own custom permission levels.The permission level in object mode is also called role definition. Its set can beSpwebObjectSproledefinitioncollectionThe first permission level exists inSproledefinitionObject. This object contains the permission level name, description, and permissions, which are stored inSpbasepermissionObject.You can use the sproleassignment object to assign permissions to external users or groups. For example, here I assign the built-in contribute permission level to a Windows domain user with the login name beyondsoft.com \ Jiangmin:

Spweb site = Spcontext. Current. Web;
// Obtain the permission level of contribute
Sproledefinition role = Site. roledefinitions [ " Contribute " ];
Sproleassignment roleassignment;
// User
String Suserid =   @" Beyondsoft.com \ Jiangmin " ;
// Email
String Semail =   " Jiangmin@beyondsoft.com " ;
// Name
String Sname =   " Min. Jiang " ;
// Annotation
String Snote =   " Related notes " ;
Roleassignment =   New Sproleassignment (suserid, semail, sname, snote );
Roleassignment. roledefinitionbindings. Add (role );
// Add users
Site. roleassignments. Add (roleassignment );

2: users and groups:The spweb object contains two spgroup object sets: groups and sitegroups. The groups set includes all groups on the current website that have been directly assigned permissions, while the sitegroups set is the superset of the groups set, including all groups created in the current website set. To create a new group, you can call the Add method of the sitegroups set. The following is an example of creating a group named newgroup and assigning the built-in contribute permission level to it on the current website.

Spweb Site2 = Spcontext. Current. Web;
Spuser currentuser = Site. currentuser;
// Create a new group
// Group Name
String Sgroupname =   " Newgroup " ;
// Owner
Spmember owner = Currentuser;
// Description
String Sdesc =   " Newgroup is created on "   + Datetime. Now. tostring ();
Site2.sitegroups. Add (sgroupname, owner, currentuser, sdesc );
// Assign Permissions
Spgroup newgroup = Site2.sitegroups [ " Newgroup " ];
Sproleassignment roleassignment2 =   New Sproleassignment (newgroup );
Sproledefinition permlevel = Site. roledefinitions [ " Contribute " ];
Roleassignment2.roledefinitionbindings. Add (permlevel );
Site. roleassignments. Add (roleassignment2 );

 

After the group is created, the user is added as a member of the group.The spgroup object provides an adduser method that accepts a spuser object.

// Add a user to the new group
Newgroup. adduser (currentuser );

Summary:This article analyzes the components and structure of the authorization management section in WSS V3, The namespace of security objects, and the encoding of security elements.

Note:

Reference:Http://msdn.microsoft.com/zh-cn/magazine/cc163287.aspx

SharePoint Services 3.0 Development Guide