SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to permission a folder using the Object Model API that is created by an ASP.NET page wrapped into a feature. I am able to create and permission the folder for users that are in the appropriate SharePoint role however, I need to permission the folders that are also in more restrictive roles. The folders are created with no problem but I need to break the inheritance and permission the folder.

I attempted to wrap the folder creation/permission code in

SPSecurity.RunWithElevatedPrivileges(delegate() { ... });

I also tried using

web.AllowUnsafeUpdates = true; 


web.Site.WebApplication.FormDigestSettings.Enabled = false;
web.Site.WebApplication.FormDigestSettings.Enabled = true;

The folder is always created however it does not permission properly. Any feedback/direction would be appreciated. Thanks.

share|improve this question
up vote 0 down vote accepted

Have you tried impersonating a user with the necessary rights:

share|improve this answer
I just tried impersonating a user with the necessary rights and the folder is created as the impersonated user however it does not permission and I am getting the error: "The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again." Any ideas on how to overcome this? Thanks. – Sean May 7 '10 at 12:32
Thanks for your help, I posted an answer of how I got it to work. I used a combination of your answer and another resource online. – Sean May 7 '10 at 13:53

Did you get a new instance of SPWeb inside the RunWithElevatedPrivileges delegate? If not, it will use the same credentials as the original request.

share|improve this answer

I ended up getting it to work with a combination of Koen Vosters answer and this link.

After impersonating the user I had to use:

web.AllowUnsafeUpdats = true;
web.AllowUnsafeUpdates = true;
while (list.RoleAssignments.Count > 0)
//Add necessary permissions
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.