SharePoint 2010 Delegated Administration

Have been wanting to try this for a while now and just now got some time to do it today.  The Central Administration site is just a SharePoint site with libraries and links, so I was curious what would happen if you were added to the site as a simple reader.  Here's the results:
As a reader and contributor, you do not gain access to Central administration and you will get the access denied error message.  The real magic comes in being in a specifically names group, there are two groups in the SCA:

• Farm Administrators
• Delegated Administrators

Full Control, Contributor and Read permission levels have no role to play in the links on the SCA.  What does matter is what group you reside in.  Being a Farm Administrator allows you to do anything in the SCA.  Being a Delegated lets you do a subset of actions, one of the items you cannot do is to create new Web Applications, but when it comes to the majority of other things, you can do them!  The thing that I would be more insterested in how one would target the links in Quick Launch to specific people.  IE, something like the following:

• Web Application manager
• Service Account Manager
• Service Application Manager (like a global service app manager role rather than manually apply to each one)
• Backup Restore Manager
• Content Deployment Manager

Service applications have a completed different architecture to them.  Each service application can have an "Administrator" assigned to it.  I found a great article that describes this process here:
http://www.sharepointanalysthq.com/2010/10/creating-a-delegated-administrator-for-a-service-application/
However, this also doesn't have much in terms of granular controls.  Its all or nothing for most of them.  These need more granular controls setup for them.  Security seems to be an afterthought in SharePoint, has been, probably always will be.

Reference:

http://blogs.architectingconnectedsystems.com/blogs/cjg/archive/2010/12/06/SharePoint-2010-Delegated-Administration.aspx

Creating a delegated administrator for a service application

One awesome thing about Service Apps in SharePoint 2010 is not only that you can have more than one of them for a particular service (for example HR and Marketing having their own Managed Metadata Service) but you can give users permissions to manage these Service Applications in Central Administration without giving them access to the whole kit and kaboodle.
This is the concept of a ‘Delegated Administrator’. A user who we want to manage a particular service application but we don’t want them to be able to see anything else. Obviously this is really useful to the SharePoint administrator because it means less work for us
So lets assume that we have a Managed Metadata Service Application that we want our non admin user, John Smith, to be able to manage. This way we can let John be an administrator just for the Managed Metadata Service without needing to expose all the other functionality.
So firstly we need to get to the Manage Service Applications screen by click on the ‘Manage Service Applications’ link from the home page of Central Admin



Then click to the right of whichever Service Application you want to create an Administrator for and select the Administrator button ( Don’t actually click on the text, but just highlight the row):




Add in our username, give them full permissions and click ok.





 Now if we log in as John we can see that we are within Central Administration but a whole lot is missing, in fact the only thing that we can see is the Service Application that we have access to.


 


 One more thing to remember is that if you remove a user from administering a Service Application they will still have access to Central Administration, all be it with nothing to see. If you want to completly remove all access for a user you will have to remove them from the delegated administrators group as well.


 


 So there you go a quick and easy way to allow your users to manage the Service Application that they need to without necessarily giving them access to the rest of Central Administration.




Reference:

http://www.sharepointanalysthq.com/2010/10/creating-a-delegated-administrator-for-a-service-application/