Restricting access to DeliverPoint

DeliverPoint allows you to easily restrict the tree view on the Farm and Account centric views, so that it is only displayed for Site Collection Administrators. You can use the information on this page if you want to restrict ALL references to DeliverPoint 2010 in the browser User Interface to Site Collection Administrators and above.

By default DeliverPoint is available on the following User Interface objects:

• Site Actions menu.
• Site Settings page for each site.
• DeliverPoint Ribbon tab when displaying a view of a list or library, edit properties page for a list item or file, and view properties page for a list item or file.
• List Item Menu on list items or files.
  

The DeliverPoint links are configured using in a Ribbon XML elements file, which contains one or more < CustomAction > tags as described below:

• Two < CustomAction > tags to define the two DeliverPoint options on the Site Actions menu, known as Microsoft.SharePoint.StandardMenu.
  
  
• Two < CustomAction > tags to define the two DeliverPoint options on the Site Settings page, known as Microsoft SharePoint.SiteSettings.
  
  
• One < CustomAction > tag to define the DeliverPoint link on the List Item Menu, known as EditControlBlock.
  
  
• One < CustomAction > tag to place the Discover Permissions option on the Ribbon on pages that display or allow you to edit item properties, known as DisplayFormToolbar.
  
  
• 39 < CustomAction> tag to configure the DeliverPoint tab for each list type, known as CommandUI.Ribbon.
  

You will need to amend each of the < CustomAction > tags in the DeliverPoint Ribbon XML elements file on every SharePoint Web-front end, if you want the DeliverPoint links to appear for only Site Collection Administrators or above, using the steps described below.

!In a production environment you will need to raise a change request to complete all the steps detailed on this page. Also, as the procedure requires an IISRESET, you will probably not be allowed to complete the task during production hours.

 Note: If an account, DOM\user1, is a site collection administrator and is also configured as a system account, the account is not identified as site collection administrator. When an account operates as the system account, it runs using the account SHAREPOINT\system. The SHAREPOINT\system account is used when a user is logged in as DOM\user1. The work around in this scenario, is to either remove the system designation for DOM\user1 or designate SHAREPOINT\system as a site collection administrator.

!Creating a new web application with a new application pool will cause the DeliverPoint User Interface feature to be re-deployed. Any customizations you have made will need to be reapplied once the web application is created. We would like to send a special thanks to the HNTB team for pointing this out to us.

To restrict access to DeliverPoint use the following steps:

1. In the browser, after installing DeliverPoint 2010, navigate to SharePoint 2010 Central Administration web site.
   
   
2. Click Site Actions, and then click DeliverPoint Configuration.
   
   
3. Click Treeview Settings.
   
   
4. In the View Restrictions section, select Yes.
   
   
5. Click OK.
   
   
6. On each SharePoint server that is running the Microsoft SharePoint Foundation Web Application service, navigate to folder:
   C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions
   \14\TEMPLATE\FEATURES\LightningTools.DeliverPoint.Web.UI2_DP10UI\DP10UI-Links
   
   
7. First take a copy of the file, Elements.xml, so you can quickly revert to a working copy of the file if you accidently incorrectly modify the file, so that the DeliverPoint User Interface object no longer work.
   
   
8. Edit the Elements.xml file in Visual Studio or Notepad.
   
   
9. Insert an additional line after line 10, Title="$Resources:LightningTools.DeliverPoint.Web.UI,DPSiteActionsDeliverPointTitle;" and type:
      RequireSiteAdministrator="TRUE"
   This will remove the DeliverPoint 2010 option from the Site Actions menu.
   
   
10. If you would also like the remove the Discover Site Permissions 2010 from the Site Actions menu, then after line 21, Title="$Resources:LightningTools.DeliverPoint.Web.UI,DPSiteActionsDeliverPointTitle;", type on a new line:
       RequireSiteAdministrator="TRUE"
    
    
11. Repeat similar configuration for the EditControlBlock, DisplayFormToolbar and Microsoft.SharePoint.SiteSettings < CustomAction > tags.
    
    
12. Then from EVERY
       < CustomAction >
       . . .
       < / CustomAction >
    section, if Rights="EnumeratePermissions" is specified, delete it.
    
    
13. Save the file.
    
    
14. Use IISReset to stop and restart the entire IIS web server on each SharePoint server where you have made the amendment.
    

References

• Microsoft SharePoint Team Blog: Enabling a Button on the Ribbon Based on Selection
• Customizing the Ribbon blog series by Chris O’Brien
• SharePoint Conference: Session SPC402 Ribbon Development and Extensibility

← DeliverPoint Central Administration
Permission Management →