SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've created a custom BDC model for reading flat files. It works great when the file is local, but now I need to roll it to test and read a shared UNC. When I direct it to read the same file from a UNC it errors Access is denied.

I used netmon to see traffic heading to my UNC is coming from the System process, not my w3wp process. My server's System process of course is running under System and cannot access UNC shares.

So for a quick fix I used some basic hard coded impersonation in my code just to prove it out, and it works. I setup my impersonation to use my sp_business account (which is what the BDC service is using) and it works great.

Now to my questions:

Can I impersonate the account that the BDC is using? I don't want to hard code anything, I want it to assume the account the service is using.

If that's not possible I will create a secure store account and grab that for impersonation. I'd rather not as that increases administration, but it's better than hard coding it.


My latest attempt looks like

    <LobSystemInstance Name="YellowPagesLOBSystemInstance">
        <Property Name="ShowInSearchUI" Type="System.String">x</Property>
        <Property Name="SsoApplicationId" Type="System.String">BDC</Property>
        <Property Name="SsoProviderImplementation" Type="System.String">Microsoft.SharePoint.Portal.SingleSignon.SpsSsoProvider, Microsoft.SharePoint.Portal.SingleSignon,Version=, Culture=neutral, PublicKeyToken=71e9bce111e9429c</Property>

Do I need to do something in my code to then reference this, to impersonate?


I failed to mention, or think about, the fact that my site is using claims based authentication with forms, using AD. I created a new web app using NTLM and created my external list and it worked.

How do I know what account is actually accessing the file? My user account has permissions, how do I know it's the sp_business account and not mine?


After further testing and banging head off keyboard, I determined that my FBA site is the route of the issue. Using SharePoint Designer, the FBA site cannot see the external content type, nor create new ones simply to a SQL database. The NTLM site can see it and connect to the same SQL database. I'll chase this down and see if it resolves.


I was missing permissions on the BDC metadata store, so setting that fixed my previous SPD issue. I created another external content type through SPD for the sake of ensuring i'm not crazy, and that worked on both sites (connecting to SQL). My bigger issue remains:

From the server console

  • NTLM site loads custom BDC
  • NTLM site loads OOTB sql ECT
  • FBA site doesn't load custom BDC
  • FBS site loads OOTB sql ECT

From my local workstation

  • NTLM site doesn't load custom BDC
  • NTLM site loads OOTB sql ECT
  • FBA site doesn't load custom BDC
  • FBS site loads OOTB sql ECT
share|improve this question
If I have a Esential List from CRM Microsoft Dynamics how can I take a data from BDC View ? – Grzegorz Z Dec 7 '12 at 9:31

In your BDC try setting the AuthenticationMode to RevertToSelf

  <LobSystemInstance Name="MyLOBInstance">
      <Property Name="AuthenticationMode" Type="System.String">RevertToSelf</Property>

You may also need to enable RevertToSelf authentication using PowerShell

$serviceApp = Get-SPServiceApplication | where {$_ -match "Name of your BCS Service App"}
$serviceApp.RevertToSelfAllowed = $true
share|improve this answer
No luck. your initial property didn't work, and I tried <Property Name="AuthenticationMode" Type="System.String">RevertToSelf</Property> – David Lozzi Nov 11 '11 at 17:40
Did RevertToSelf make any difference in the account that was accessing the UNC? How is the BDC being accessed? From a BDC Web Part, custom Web Part, custom application, something else? Just wondering how the code where you coded the impersonation fits in. – MLF Nov 11 '11 at 18:20
I don't think it made much difference, still get the error. How can I know what account actually accessed the UNC? The BDC is being accessed through an External List on a CBA site using FBA with AD accounts – David Lozzi Nov 11 '11 at 18:23
In that case using RevertToSelf should cause access to the UNC to be made with the Identity of the Application Pool of the CBA site. Now that I read your question again, if you want access to be made as the Identity that the BCS Service application runs as I don't think that is possible using just the BDC definition. – MLF Nov 11 '11 at 18:27
see my latest update above. – David Lozzi Nov 11 '11 at 18:36
up vote 0 down vote accepted

I got this to work using impersonation within the code.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.