Wednesday, April 18, 2012

SharePoint search returns no results for most users

There are many reasons that SharePoint search doesn't return results. The simpler ones like the crawl failed, scope not crawled. If you are in a dev environment, it's likely that you suffer from sloppy use of service accounts. What I learned in a hard way recently is that in a new dev envrionment that I spun up, I was using the the farm admin account as the site collection admin on a site collection, and also use it as the crawl account. Using farm admin as the crawl account is not a best practice security wise but is actually done often to avoid many search related headaches. What I did not realize, is that using it as the site collection admin resulted in the search only returns results for this account in the site sollection. Logged in as any other accounts, search would return no results. In fact, the crawler account should only have explicit read permission in a site collection in order for the search results to return properly for any user. Even though the farm admin account has implicit permissions to any site collection, it must not have explicit site collection admin, site owner etc permissions on the site collection.

Labels: , , ,

Monday, January 23, 2012

SharePoint anonymous access permission

Came across a good explanation on what exact permissions that SharePoint anonymous access has:

"In SharePoint, anonymous users' rights are determined by the Limited Access permission level. Limited Access is a special permission level that cannot be assigned to a user or group directly. The reason it exists is because if you have a library or subsite that has broken permissions inheritance, and you give a user/group access to only that library/subsite, in order to view its contents, the user/group must have some access to the root web. Otherwise the user/group will be unable to browse the library/subsite, even though they have rights there, because there are things in the root web that are needed to render the site or library. Therefore, when you give a group permissions only to a subsite or library that is breaking permissions inheritance, SharePoint will automatically give Limited Access to that group or user on the root web.

......If you want to see what rights Limited Access is composed of in your site, go to http://SERVER/_layouts/role.aspx and click on Limited Access. "

For more descriptions, see the original post
http://blogs.msdn.com/b/ecm/archive/2007/05/12/anonymous-users-forms-pages-and-the-lockdown-feature.aspx

Labels: , , ,