Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
  1. I can add an item to SharePoint (with the object model) when I am logged in to SharePoint with an administrative account.

  2. However, if I change to another user who is NOT listed in the backend SQL server database then the item add fails.

  3. I get access failed. The log states it has to do with that user not being in the SQL server database.

  4. That's why I need to use the service account in order to add an item to the SharePoint site with the object model.

  5. I tried using SPSecurity.RunWithElevatedPrivileges(delegate() but am still getting same error.

Anyone???

share|improve this question
    
What do you mean with a user 'not being listed' in the backend SQL Server database? Can you include the relevant entries from the Windows Application and Security Event logs? –  Muhimbi Apr 27 '10 at 5:07

5 Answers 5

Besides getting the logs as Jeroen suggests, please also include details on what type of project you are creating, and the context in how you access SharePoint (eg. event handler, timer job, console application, web part).

If you run in context of the IIS SharePoint will impersonate your user. That means that all database access runs in context of the application pool user, so SQL exceptions shouldnt be related to your current user not having access to SQL.

If you for example in a web part use the object model to retrieve items that your current user does not have access to in SharePoint, it will give you a security exception.

What running with elevated privileges does, is switching context to disable impersonation, so for that to work you need to run impersonated in the first place. This is why RWEP will not work when you are not running in IIS context (again like a web part).

Also RWEP has some issues, so be careful when using it and be sure you understand why you are using it, or you are better off first investigating why your code fails in the first place.

Another option is using SPUserToken for impersonation. Read more about this here and here.

Again: tell us a bit more about what you want to achieve and how you are going about implementing it, to make us help you more.

share|improve this answer

Are you creating a new Instance of the SPWeb inside the SPSecurity.RunWithElevatedPrivileges(..) block? If you aren't the code you're running will still use the original users credentials because the SPWeb (or SPSite) objects hold onto the permissions they were created with.

private void Example(SPWeb web)
{
    SPSecurity.RunWithElevatedPrivileges(delegate() {
        // this will fail for normal users because the web is
        // holding onto the credentials it was created with  
        web.BreakRoleInheritance(false);  

        using (SPSite elevatedSite = new SPSite(web.Site.ID))
        using (SPWeb elevatedWeb = elevatedSite.OpenWeb(web.ID))
        {
            // This one should work
            elevatedWeb.BreakRoleInheritance(false);
        }
    });        

}
share|improve this answer

Great said guys. Here are the details.....

It's a C#, 3.5 framework, vs2008, class project. 2. Event hander used is "ItemUpdated" 3. I added SPSecurity.RunWithElevatedPrivileges(delegate() 4. I am also creating a folder in the current document library - this piece works fine. 5. Then I use this code to make my folder read only but it's giving this error. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

I understand the test user does not have rights to make this folder read only. But I thought runwithprivileges takes care of issues like this. if not, how do I handle this.

    private void FolderReadOnly(SPWeb web, SPListItem folder)
    {
        if (!folder.HasUniqueRoleAssignments)
        {
            //Setting false erases all permissions, so now the folder is hidden from everyone.
            folder.BreakRoleInheritance(false);
            folder.SystemUpdate(false);
        }
        SPRoleDefinition role = web.RoleDefinitions["Read"];
        SPGroupCollection collGroups = web.SiteGroups;
        foreach (SPGroup group in collGroups)
        {
            SPPrincipal principal = group;
            SPRoleAssignment roleAssign = new SPRoleAssignment(principal);
            roleAssign.RoleDefinitionBindings.Add(role);
            folder.RoleAssignments.Remove(principal);
            folder.RoleAssignments.Add(roleAssign);
            folder.SystemUpdate(false);
        }
    }
share|improve this answer

Still the same issue. All the codes is under RunWithElevatedPrivileges. Code breaks at this line folder.BreakRoleInheritance(false);

Error is shown below...

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex) at Microsoft.SharePoint.Library.SPRequest.ResetSecurityScope(String bstrUrl, UInt32 dwObjectType, String bstrObjUrl, Guid guidDoc, Boolean bUnique, Boolean bCopyRoleAssignments, Guid& pguidScopeId, Int32& piError) at Microsoft.SharePoint.SPSecurableObjectImpl.RevertRoleInheritance(Boolean copyRoleAssignments) at Microsoft.SharePoint.SPSecurableObjectImpl.BreakRoleInheritance(Boolean CopyRoleAssignments) at Microsoft.SharePoint.SPListItem.BreakRoleInheritance(Boolean CopyRoleAssignments) at ItemLevelPermissions.clAddPermissions.<>c_DisplayClass1.b_0()

share|improve this answer

I post a working code shortly. Stand by.....

share|improve this answer
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  John Chapman Oct 18 '12 at 14:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.