Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Breaking my head with this issue for the past 2 days!

Received Access Denied error in SPD so tried to set Meta Data permission and get the following error.

enter image description here

  1. I am one of the Admins for BSC service Applications
  2. I belong to Farm Admin Group
  3. I have required permission in SQL
  4. Tried opening CA in Admin Mode (IE -> Run as Administrator)
  5. ULS Logs shows the following

    Access Denied for User '0#.w|domain\skumar', which may be an impersonation by 'DOMAIN\skumar'. Securable IMetadataCatalog with Name 'ApplicationRegistry' has ACL that contains:

Any more ideas? please let me know if you need more information.

Edit:

Here is the stack trace

'BCS' BdcServiceApplication logging server side AccessDeniedException before marshalling and rethrowing on client side: Access Denied for User '0#.w|domain\skumar', which may be an impersonation by 'domain\skumar'. Securable IMetadataCatalog with Name 'ApplicationRegistry' denied access. Stack Trace: at Microsoft.SharePoint.BusinessData.SharedService.IndividuallySecurableMetadataObjectAccessor.SetAccessControlEntries(MetadataObjectStruct metadataObjectStruct, AccessControlEntryStruct[] aces, String settingId, DbSessionWrapper dbSessionWrapper) at Microsoft.SharePoint.BusinessData.SharedService.BdcServiceApplication.<>c_DisplayClass2c.b_2b() at Microsoft.SharePoint.BusinessData.SharedService.BdcServiceApplication.Execute[T](String operationName, UInt32 maxRunningTime, ExecuteDelegate`1 operation)

share|improve this question
    
What's the value of AuthenticationMode element in the XML Metadata Model file that External Content Type? –  Ashish Patel Jun 14 '11 at 16:26
    
Can you provide the full stack trace of the Access Denied exception so we can see what operation you were trying to perform. –  Steve P Jun 14 '11 at 18:54
    
@Ashish .. I get Access Denied while creating the new ext content type and the suggested fix was to add meta data permissions. I am site collection admin too. –  Shoban Jun 15 '11 at 5:08
    
@Steve P I have edited the question to include Stack Trace. –  Shoban Jun 15 '11 at 5:09
    
In the Managed Metadata Database are you listed as one of the Principals in the ECMPermission Table? –  MichaelF Jun 16 '11 at 19:37

2 Answers 2

up vote 6 down vote accepted

Our solution was to go to SP Central Admin > System Settings > Services on Server and start the "Claims to Windows Token Service". We also found this error in the logs which helped lead us to this as the solution:

SPSecurityContext.WindowsIdentity: Could not retrieve a valid windows identity for NTName='PRMM-SP\polyadmin', UPN='PolyAdmin@PRMM-SP.local'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2 that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.IO.PipeException: The pipe endpoint 'net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2' could not be found on your local machine.

For us I feel that this situation may only occur because the user we are trying to add in the metadata permissions has both an AD and ADFS (claims) entry. I have seen where EnsureUser or some other API call fails when you have identical IDs across two user stores.

share|improve this answer
    
Thanks to @el_hombre who did the work behind the scenes and found the answer. –  Kirk Liemohn Jan 31 '12 at 22:02
    
More than one week I was confused with this error... Thanks for your answer. –  Milad Rk Mar 19 at 6:22

It sounds as though need to go into your Business Data Connectivity Service Application, and set the permissions on the object. First, go to Central Administration->Application Management->Manage service applications. Find your Business Data Connectivity service application and go to the Manage page. Select the external content type and go to Set Permissions on the ECB menu, or the Set Object Permissions on the ribbon. From the Set Object Permissions pop-up dialog page you can add accounts and set their permissions. You will need to give the user who is logging in to SharePoint at least Execute permission to be able to see the list items (not to be confused with the account that will access the database).

I have blogged a few error messages like this one that keep catching me out.

share|improve this answer
    
Read your anwer quickly and This is when I get the error :-) I dont have access to SharePoint site now. Will check and update you. Thanks –  Shoban Jul 13 '11 at 11:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.