How To: Configure permissions in Out-of-the-box MOSS 2007 Approval Workflow such that “Approvers” cannot edit or delete the item to be approved

1. Consider a Microsoft Office SharePoint Server 2007 site that will be used as a “Document Approval System”. Certain users will be “Editors” and they will be able to upload documents for approval. Another set of users will be “Approvers”. These users can either approve or reject the uploaded documents. The security requirement is that “Editors” should not be able to approve the documents and the “Approvers” should not be able to edit or delete the documents.

2. Create a document library where the documents will be uploaded.

In this document library, create an Out-of-the-box MOSS 2007 Approval Workflow. In the “Select a task list to use with this workflow”, select “New task list”.

3. In the text box for “Approvers”, add the windows group that will contain all the “Approver” users. Also so that an editor cannot change this “Approver” group at the time the workflow is being created, uncheck the “Allow changes to the participant list when this workflow is started” checkbox.

4. As you can see a new task list is created for this workflow.

5. Give Contribute permissions on the site to the windows group that will contain the “Editors”.

This group can now add, edit and delete items from lists.

6. Now login as an “Editor” and upload a document.

Start the workflow on the uploaded document.

As you can see the approvers text box is disabled.

Once the workflow is started, a task is created in the task list specific to this workflow.

7. Let us see what happens if the “Editor” tries to approve the document herself.

We are trying to approve a workflow logged in as an editor.

The “Editor” will get an error message and the following will be added to the workflow history.

8. Now login as the “Administrator” and create a new permission level for the “Approver”. Give this permission level, edit items, view items, open items, view versions and view application pages permissions.

9. Create a new Share Point group for workflow approvers. Give it read permissions on the site.

Give the same group edit permissions on the workflow task list (that was specifically created for the approval workflow) using the “WorkflowApprovalPerm” permission just created.

The Share Point group “Workflow Approvers” now has the following effective permissions on the site. Effectively it has read-only permissions on the entire site, but “edit” permissions on the task list specific to the approval workflow.

10. Add the windows group containing all the approvers to this “Workflow Approvers” Share Point group.

11. Now login as an “Approver”. Go to the document library. See that the approver can neither edit nor delete the uploaded documents.

12. Go to the task created for approval. Try to approve it.

As you can see the “Approver” is able to approve the document.

Summary:-

This “How To” shows that it is possible using the out-of-the-box MOSS 2007 approval workflow to create a document approval system where

1. The “Editors” can only upload documents to be approved but cannot approve the documents themselves.

2. The “Approvers” can only approve or reject the documents but cannot edit or delete them.

Comments

• Anonymous
  August 06, 2008
  PingBack from http://stevepietrek.com/2008/08/06/links-862008/

• Anonymous
  August 11, 2008
  Entwicklung SharePoint developer bookmarklets Consistent development of Master Pages, Page Layouts and

• Anonymous
  August 11, 2008
  Entwicklung SharePoint developer bookmarklets Consistent development of Master Pages, Page Layouts and