PWA

Users, groups, permissions, and permission levels are used to configure access within a MOSS Web application. MOSS provides management and configuration functionality for these objects. In MOSS, users are added from the directory service such as Active Directory. Once users are added to a site collection, they are added to groups and assigned permissions on sites, lists, and items. MOSS supports the creation of SharePoint groups, for which the memberships are maintained within MOSS. Additionally, Active Directory security groups may also be used directly in MOSS. Active Directory group memberships are managed in Active Directory.

Users and groups gain access or are restricted access to sites and Web Parts based upon permission levels set for the users and groups. Permissions are individual rights that may be performed by a user in a site, list, or item and so these types of permissions are referred to as Site Permissions, List Permissions, and Item Permissions, respectively. There are over thirty permissions in MOSS.

Permissions are applied to users and groups using permission levels. Permission levels allow roles to be defined, consisting of unique combinations of individual permissions. MOSS provides some default permission levels such as "Contribute and "Full Control," but in addition to using the default permission levels, custom permissions can be created in cases where a more appropriate name is required or a unique combination of permissions is more appropriate than what is available by default. Existing permission levels may be copied and used as starting point when creating custom permission levels. Permissions are assigned to users and groups in a similar fashion as in the Windows operating system. Much like the access control lists that allow assigning permissions to users and groups on Windows folders, MOSS provides similar access control lists on sites, lists, and items.

The relationship between sites, lists, and items is hierarchical in nature and the default behavior within MOSS web applications is that the permissions are inherited by child objects from the parent objects. In cases where business requirements are such that a child object is required to have different permissions than the parent object, then the permission inheritance chain may be broken manually using the access control list of the child object and the child object may be configured with permissions different from its parent. When this type of modification is made then all child objects of the modified object inherit the new settings.

To provide an example of this, imagine a MOSS site that contains a document library, which contains a set of documents. By default, the document library will inherit permissions from its parent site and each document contained within the document library will inherit permissions from the document library. Say, for instance, that there is a requirement that the document library has different permissions than the site; perhaps a group of users should be able to read contents of a site, but not be able to view contents of a document library. The permissions for the document library may be configured accordingly. Doing so will achieve the desired result and not affect the permissions of the parent site. Additionally, individual document (item) permissions may be configured so that they have different permissions than the modified document library. Keep in mind that since the relationship between the objects is hierarchical, users must at least have read access to the parent in order to gain access to the child object.

The access control lists for sites, lists, and items are very similar. However, lists provide one additional configuration menu called advanced settings, which allows an added layer of security to be set on the child items. Within advanced settings specifications may be made such that users can view all items or view only their own items. There is also a setting for specifying that users can edit all items, their own items, or no items in the list.

Additionally, document libraries can contain folders and it is possible to set permissions on these folders.

dont forget to mark this as "Accepted Answer" if you liked it