Creating a custom Document Library in SharePoint

Question

I have a document library in my SharePoint page and there are 10 documents in it. If UserA is logged in i want him to only see 5 of those doucments in that document library. How can i create some custom document library for this to work?

I have MOSS installed as well.

Thanks in advanced!

Answer 1

You could configure different permissions on each document in the document library. Just select the "Manage Permissions" option on each item and break the permission inheritance from the document library level. Just note that having too many documents with item level permissions can create a maintenance nightmare for you. Another option could be to create two document libraries with different permissions.

Answer 2

Write an ItemEventReceiver that breaks the permissions based on a field in the library, i.e. a column that holds the different roles .

We have done this by creating a list that holds all roles coupled to sharepoint groups.

i.e.

Administrator -> Owners of website (SPGroup), Company Administrators (SPGroup)

Managers -> Managers (SPGroup)

then in our content type we have a lookup column to this list.

Here's the code for the ItemEventReceiver:

public override void ItemUpdated(SPItemEventProperties properties)
{
lock (_lock)
{
try
{
    using (SPSite site = new SPSite(properties.SiteId,
      properties.ListItem.ParentList.ParentWeb.Site.SystemAccount.UserToken))
    using (SPWeb web = site.OpenWeb(properties.RelativeWebUrl))
    {
     web.AllowUnsafeUpdates = true;
     var item = web.Lists[properties.ListId].GetItemById(properties.ListItemId);

     var roles = item["Roles"] as SPFieldLookupValueCollection;
     var rolesList = web.Site.RootWeb.Lists["Company Roles"];
     var groupsToAdd = new List<SPFieldUserValue>();

     if (item.HasUniqueRoleAssignments)
     {
      item.ResetRoleInheritance();
      item = item.ParentList.GetItemById(item.ID);
     }

     if (roles != null && roles.Count > 0)
     {
      // Iterate over the roles and see if there is a group associated
      foreach (var role in roles)
      {
       var roleItem = rolesList.GetItemById(rol.LookupId);
       if (roleItem != null)
       {
        // This is the SPgroup field in the rolesList
        var groups = roleItem["Groups"] as SPFieldUserValueCollection;
        if (groups != null)
        {
         groupsToAdd.AddRange(from g in groups
               where g.User == null
               select g);
        }
       }
      }
      if (groupsToAdd.Count > 0)
      {
       item.BreakRoleInheritance(false);
       foreach (var value in groupsToAdd)
       {
        var group = web.Groups[value.LookupValue];
        var assignment = web.RoleAssignments.GetAssignmentByPrincipal(group);
        item.RoleAssignments.Add(assignment);
       }
      }
     }

     DisableEventFiring();
     item.SystemUpdate(false);
     EnableEventFiring();
    }
}
catch (Exception ex)
{
    //LOG ERROR
}
}
}

Answer 3

If the coding doesn't work for you, and you'd rather not set permissions on each file, then there is a third option. We use folders with permissions set on them.

e.g.

Create a folder called "Managers", break permissions, and set rights to only the managers. Create another folder called "Employee 1", break permissions, and set Contribute rights to the Employee and the Employe's manager.

Place the files in the appropriate folders and it will inherit rights from the folder.

This way, managers can see the manager files, and all files of their employees. Users can only see their own files.

Similar logic can be done for Headquarters, Region 1, Region 2, etc ... and creating different Groups for each region and then assigning the group to the folder's permissions.

Note, there's always concern in using this design on maintaining all the permissions and on performance, but we've been doing similar things for 750+ user populations and thousand of docs and it's been working fine for us so far.

Henry