Restricting access to DeliverPoint

DeliverPoint allows you to easily restrict the tree view on the Farm and Account centric views, so that it is only displayed for Site Collection Administrators.

You can use the information on this page if you want to restrict ALL references to DeliverPoint in the browser User Interface to Site Collection Administrators and above.

By default, DeliverPoint is available on the following User Interface objects:

• Settings menu.
• Site Settings page for each site.
• DeliverPoint Ribbon tab, for example, when displaying a view of a list or library, edit properties page for a list item or file, and view properties page for a list item or file.
• List Item Menu on list items or files.
  

The DeliverPoint links are configured using a Ribbon XML elements file, which contains one or more < CustomAction > tags as described below:

• Two < CustomAction > tags to define the two DeliverPoint options on the Site Actions menu, known as Microsoft.SharePoint.StandardMenu.
• Two < CustomAction > tags to define the two DeliverPoint options on the Site Settings page, known as Microsoft SharePoint.SiteSettings.
• One < CustomAction > tag to define the DeliverPoint link on the List Item Menu, also known as EditControlBlock.
• One < CustomAction > tag to place the Discover Permissions option on the Ribbon on pages that display or allow you to edit item properties, known as DisplayFormToolbar.
• 39 < CustomAction> tags to configure the DeliverPoint tab for each list type, known as CommandUI.Ribbon.
  

You will need to amend each of the < CustomAction > tags in the DeliverPoint Ribbon XML elements file on every SharePoint Web front-end, if you want the DeliverPoint links to appear for only Site Collection Administrators or above, using the steps described below.

!In a production environment you will need to raise a change request to complete all the steps detailed on this page. Also, as the procedure requires an IISRESET, you will probably not be allowed to complete the task during production hours.

 Note: If an account, DOMAIN\user1, is a site collection administrator and is also configured as a system account, the account is not identified as site collection administrator. When an account operates as the system account, it runs using the account SHAREPOINT\system. The SHAREPOINT\system account is used when a user is logged in as DOMAIN\user1. The work around in this scenario, is to either remove the system designation for DOMAIN\user1 – or – designate SHAREPOINT\system as a site collection administrator.

!Creating a new web application with a new application pool will cause the DeliverPoint User Interface feature to be re-deployed. Any customizations you have made will need to be reapplied once the web application is created. We would like to send a special thanks to the HNTB team for pointing this out to us.

To restrict access to DeliverPoint use the following steps:

1. In the browser, after installing DeliverPoint, navigate to SharePoint Central Administration web site.
   
   
2. Click Settings , and then click DeliverPoint Configuration.
   
   
3. Click Treeview Settings.
   
   
4. In the View Restrictions section, select Yes.
   
   
5. Click OK.
   
   
6. On each SharePoint server that is running the Microsoft SharePoint Foundation Web Application service, navigate to folder:
   C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions
   \15\TEMPLATE\FEATURES\LightningTools.DeliverPoint.Web.UI_DP13UI\DP13UI-Links
   
   
7. First make a copy of the file, Elements.xml, so you can quickly revert to a working copy of the file, in case of accidental changes causing the DeliverPoint User Interface object to no longer work.
   
   
8. Edit the Elements.xml file in Visual Studio or Notepad.
   
   
9. Insert an additional line after line 10, Title="$Resources:LightningTools.DeliverPoint.Web.UI,DPSiteActionsDeliverPointTitle;" and type:
      RequireSiteAdministrator="TRUE"
   This will remove the DeliverPoint option from the Settings menu.
   
   
10. If you would also like to remove the Discover Site Permissions from the Settings menu, then after line 21, Title="$Resources:LightningTools.DeliverPoint.Web.UI,DPSiteActionsDeliverPointTitle;", type on a new line:
       RequireSiteAdministrator="TRUE"
    
    
11. Repeat similar configuration for the EditControlBlock, DisplayFormToolbar and Microsoft.SharePoint.SiteSettings < CustomAction > tags.
    
    
12. Then from EVERY
       < CustomAction >
       . . .
       < / CustomAction >
    section, if Rights="EnumeratePermissions" is specified, delete it.
    
    
13. Save the file.
    
    
14. Open a Command Prompt and type IISRESET to stop and restart the entire IIS web server on each SharePoint server where you have made the amendment.
    

References

• Microsoft SharePoint Team Blog: Enabling a Button on the Ribbon Based on Selection
• Customizing the Ribbon blog series by Chris O’Brien
• SharePoint Conference: Session SPC402 Ribbon Development and Extensibility