Have been dealing with an issues for some time that had me stumped. We are using Sharepoint 2013 Enterprise on-premise. We have a Forms site collection where all of our InfoPath forms are published. Each Form has it’s own Forms Library so that fine-grained permissions can be set on the forms libraries as needed. For most forms, end users only need to be able to submit a form and see their own… nothing more. All of that seems to work well. There are a couple of Sharepoint Groups that get elevated privileges on certain forms to be able to do their work (and view all forms in the library).
We had an issue where one SharePoint Group (AP) needed permissions to end workflows and restart them on one given form library (and it’s associated workflow_tasks list). We gave the group Edit permissions on the forms library and Full Control on the Workflow_Tasks list (this workflow task lists only has workflow tasks for this one form).
However, when the AP supervisor tried to end a workflow, she would get the “Sorry, this site has not been shared with you message”.
The solution I found for the moment at least was to add the AP supervisor to the Members group for the site collection which has Edit permissions by default. This isn’t an ideal solution, however, as it gives her permissions to other forms that she really doesn’t need.
When I look at the AP Groups permissions I see Limited Access at the Site Collection Level, which I would expect as they have permission at a lower level that were created by breaking inheritance in the site collection.
We want to keep all of the forms in a single site collection if possible to make it easier for employees and managers to go to one location to submit and approve forms.
What I’m wondering though, is there a better way to have set the AP Groups permissions to make ending and restarting workflows possible without giving additional permissions to all other forms libraries in the site collection?
