I've added some users to a subsite in WSS (v2, SP1), but they are unable
to access the site. They receive access denied messages. They are not
members of the parent site. I gave parent site access to one of the
affected users, and they were able to access.

Do users need to have access to all ancestor sites? Or is there another
way to allow access to the site?

Hi Shawn,

"Do users need to have access to all ancestor sites? Or is there another
way to allow access to the site?"
In fact, this is decided by how you create the sub site under WSS.

If we create the sub site under the parent site "Use same permissions as
parent site"(the option in the create site page), the sub site will have
the same user permission control as the parent site. With this option, each
sub site in the whole site collections will all have the same permission
control to the parent site. At your scenario, the sub site should be
created in this way.

If we choose "Use unique permissions " at creating the site, it will
maintain its own permission control.

In a word, we could use the option "Use same permissions as parent site" to
keep the same security control to all the sits.

Please feel free to let me know if you have any further question on this
issue.

Best Regards,
Wei-Dong Xu
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN outages or "business down"
situations. This benefit is available 24 hours a day, 7 days a week to all
Microsoft technology partners in the United States and Canada.
This and other support options are available here:
BCPS:
<https://partner.microsoft.com/US/technicalsupport/supportoverview/40010469>

Others: <https://partner.microsoft.com/US/technicalsupport/supportoverview/>
If you are outside the United States, please visit our International
Support page:
<http://support.microsoft.com/default.aspx?scid=%2finternational.aspx>.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Shawn,

In addition, we have one way to know how to control the user for one site
by browsing to the "site settings". If the Administration section of site
setting only list two links, it means this site is created "Use same
permissions as parent site". There is no need for the sub site admin to
control the user permission. We will need to check the parent site to
control the users.

If there are four links under site settings, it means this site is created
"Use unique permissions". The sub site admin could directly add the user
for the permission control.

Please feel free to let me know if any further question on this matter.

Best Regards,
Wei-Dong Xu
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN outages or "business down"
situations. This benefit is available 24 hours a day, 7 days a week to all
Microsoft technology partners in the United States and Canada.
This and other support options are available here:
BCPS:
<https://partner.microsoft.com/US/technicalsupport/supportoverview/40010469>

Others: <https://partner.microsoft.com/US/technicalsupport/supportoverview/>
If you are outside the United States, please visit our International
Support page:
<http://support.microsoft.com/default.aspx?scid=%2finternational.aspx>.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi Wei-Dong,

Thanks for a clear answer. One question: Is it possible to change an
existing site from one type of permission to the other? And, after
doing so, will the existing permissions be transferred to the new set
of permissions? As an example, say I have a site set up to inherit the
permissions from the parent. I decide to change it to unique
permissions. Will the permissions from the parent still exist after
I've changed to unique, or will I need to recreate them? It seems like
this would be a common situation, where you wanted to retain the
permissions from the parent site but add additional users to a child,
no?

Thanks for any information you provide!

The sub-site is using unique permissions. It has it's own permission
list, and the users are listed as members of the site. But the users
are unable to access the site unless they are added as members of the
parent site as well.

Wei-Dong XU [MSFT] wrote:
[..]

I found the problem. We had a brreadcrumb control on the site that was
trying to get the name of the parent from the Object Model. Since the
users didn't have access to the parent, they were getting an access error.

Shawn Kovalchick wrote:
[..]

Great news! :-) Thanks for sharing this resolution to the community!

Have a nice day!

Best Regards,
Wei-Dong Xu
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN outages or "business down"
situations. This benefit is available 24 hours a day, 7 days a week to all
Microsoft technology partners in the United States and Canada.
This and other support options are available here:
BCPS:
<https://partner.microsoft.com/US/technicalsupport/supportoverview/40010469>

Others: <https://partner.microsoft.com/US/technicalsupport/supportoverview/>
If you are outside the United States, please visit our International
Support page:
<http://support.microsoft.com/default.aspx?scid=%2finternational.aspx>.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Is there a way to check your permissions for an object? I'm trying to
modify the breadcrumb control to either get the name and url via some
other method, or ignore the object entirely?

Alternateively, is there a way to turn off prompting for credentials in
the event a user does not have rights to an object, and let the code
throw an exception?

Wei-Dong XU [MSFT] wrote:
[..]

Hi Shawn,

"Is there a way to check your permissions for an object? "
I'd like to know what the meaning of "an object" is, one list or the doclib
or any other thing? If it is a list, we could use the SPPermission Class of
SPS object model to obtain the perssmion data.

"...breadcrumb control..."
"...let the code throw an exception..."
Is this control developed by you or from one 3rd party provider. If from
you, the development on SPS is not supported at this newsgroup. Please post
at the public newsgroup which is monitored by Microsoft. We will be of any
assistance for you regarding the development there:
microsoft.public.sharepoint.portalserver.developme nt

Thanks!

Wei-Dong Xu
Microsoft Online Partner Support
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
Business-Critical Phone Support (BCPS) provides you with technical phone
support at no charge during critical LAN outages or "business down"
situations. This benefit is available 24 hours a day, 7 days a week to all
Microsoft technology partners in the United States and Canada.
This and other support options are available here:
BCPS:
<https://partner.microsoft.com/US/technicalsupport/supportoverview/40010469>

Others: <https://partner.microsoft.com/US/technicalsupport/supportoverview/>
If you are outside the United States, please visit our International
Support page:
<http://support.microsoft.com/default.aspx?scid=%2finternational.aspx>.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

The object on which I need to check the permissions is of type SPWeb. I
need to check what rights I have to the SPWeb object before querying its
name, url, and parent web.


Wei-Dong XU [MSFT] wrote:
[..]

Hi Shawn,

You could visit the SPWeb.Permissions property to obtain the SPWeb object
permission information. The Permissions property is the
SPPermissionCollection collection class. After that, we could use the code
below to obtain the object information:
////////////////////////////////////////////////////////////////////
SPWeb site = new SPSite("http://<your WSS site>").OpenWeb();
foreach (SPPermission spp in site.Permissions)
Console.WriteLine(spp.Member.ToString());
////////////////////////////////////////////////////////////////////

Please feel free to let me know if you have any further question on this
matter.

Best Regards,
Wei-Dong XU
Microsoft Product Support Services
This posting is provided "AS IS" with no warranties, and confers no rights.
It is my pleasure to be of assistance.