Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

When a Site event feature is activated I am trying to set some properties on the web application. My feature uses this value.

 public override void FeatureActivated(SPFeatureReceiverProperties properties)
        {
            SPSecurity.RunWithElevatedPrivileges(delegate()
            {
                SPSite site = properties.Feature.Parent as SPSite;
                if (site != null)
                {
                    SPWebApplication web = site.WebApplication;
                    web.Properties["test"] = "test";
                    web.Update();
                }
            });
        }

This however is giving me the following errors in Event Viewer.

Log Name: Application Source: Microsoft-SharePoint Products-Web Content Management Date: 08/02/2012 11:06:53 Event ID: 7363 Task Category: Publishing Cache Level:
Critical Keywords: User: USER NAME Computer:
SERVER NAME Description: Object Cache: The super reader account utilized by the cache does not have sufficient permissions to SharePoint databases. To configure the account use the following command 'stsadm -o setproperty -propertyname portalsuperreaderaccount -propertyvalue account -url webappurl'. It should be configured to be an account that has Read access to the SharePoint databases. Additional Data: Current default super reader account: NT AUTHORITY\LOCAL SERVICE

followed by

Log Name: Application Source: Microsoft-SharePoint Products-SharePoint Foundation Date: 08/02/2012 11:07:08 Event ID: 6615 Task Category: Runtime Level: Error Keywords: User: NT AUTHORITY\IUSR Computer:
COMOUTER Description: Access denied.

Why am I getting an Access denied when I am running with RunWithElevatedPrivileges?

Update

From @SPArchaeologist feedback but not taking hi sadvice I have tried to turn off RemoteAdministratorAccessDenied. I have also removed RunWithElevatedPrivileges as we don't think it is needed.

    public override void FeatureActivated(SPFeatureReceiverProperties properties)
    {
        var remoteAdministratorAccessDenied = SPWebService.ContentService.RemoteAdministratorAccessDenied;
        if (SPWebService.ContentService.RemoteAdministratorAccessDenied == true)
        {
            SPWebService.ContentService.RemoteAdministratorAccessDenied = false;
            SPWebService.ContentService.Update(true);
        }


        SPSite site = properties.Feature.Parent as SPSite;
        if (site != null)
        {
            SPWebApplication web = site.WebApplication;
            web.Properties["test"] = "test";
            web.Update();
        }

        SPWebService.ContentService.RemoteAdministratorAccessDenied = remoteAdministratorAccessDenied;
        SPWebService.ContentService.Update(true);
    }

Still getting the same errors as before.

The scope of my feature is Site.

Update

web.update() & SPWebService.ContentService.Update(true); are giving the access denied.

share|improve this question
    
SPSecurity.RunWithElevatedPrivileges doesn't give you an access to external resources. It gives you the rights of application pool account of your web application - so it not guarantees an access to you. –  Alex Boev Feb 8 '12 at 11:25
1  
Can you debug the receiver and tell us which line give the access denied error? I would also suppose that a site scoped feature doesn't have the permission required to set the RemoteAdministratorAccessDenied, as that would destroy any purpose of the security setting. –  SPArchaeologist Feb 8 '12 at 12:38
1  
I've tried in the past your trick with "temporary" disable RemoteAdministratorAccessDenied and it was not working for me, only disable using powershell –  Kai Feb 8 '12 at 14:07
add comment

3 Answers 3

up vote 10 down vote accepted

From your code it would seem that you are trying to set a web-application property from a site collection scoped feature.

If you are using SharePoint 2010, I can assume that you are experiencing the effect of the new "RemoteAdministratorAccessDenied" security setting, which among the others by default block any attempt to alter a web app property from a site collection / web site scope (Taken from Ms knowledgbase: "This feature explicitly blocks any modifications to the objects inheriting from SPPersistedObject in the Microsoft.SharePoint.Administration namespace and does not allow the content web applications to update the configuration database"). If this is your case you have two possibile solution:

  • Rescope your features so that web application related activity are performed by a web application scoped feature

  • Disable the security setting (I won't suggest this, the security setting was created with a purpose in mind), either via power shell or a console app. Notice that you cannot use a site scoped feature - this would just throw another Access Denied error.

    function Set-RemoteAdministratorAccessDenied-False() { [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint") > $null [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Administration") > $null # get content web service $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService # turn off remote administration security $contentService.RemoteAdministratorAccessDenied = $false $contentService.Update()
    } Set-RemoteAdministratorAccessDenied-False

If you are using SharePoint 2007, remember that by using SPSecurity.RunWithElevatedPrivileges you will just impersonate the app pool account (which may or may not have sufficient right to update the web app settings). Anyway, your actual code is not using the RunWithElevatedPrivileges construct correctly. You need to recreate the SPSite / SPWeb instance inside the delegate, or the impersonation won't work.


Note: currently fighting to format the powershell snippet above. If anyone want to edit, fell free to fix the formatting and remove this notice.

share|improve this answer
    
I thought RemoteAdministratorAccessDenied prevents access to the Config DB (SPPersistedObject), not the Web App itself. An application pool account certainly should have access to modify it's own settings! The culprit is likely the misuse of the SPSite object or the need to rescope as webapp feature. –  Louis Feb 8 '12 at 11:59
    
@Louis The scope is site at the moment. How could I be misusing the SPSite object? –  John Feb 8 '12 at 12:14
2  
@John: he was referencing to your original code: as said above, by using the "properties.Feature.Parent as SPSite" as a reference inside the RunWithElevatedPrivileges block and not recreating the SPSite instance the impersonation wouldn't work. –  SPArchaeologist Feb 8 '12 at 12:42
    
very intuitive post... –  Falak Mahmood Feb 8 '12 at 21:11
add comment

It appears from the code that your application pool account is trying write into the SharePoint Configuration Database. However, it is not the best practice to grant application pool account to run as a Farm administrator and make changes to the Configuration database.

share|improve this answer
add comment

I have had the same issue. My problem is that I NEED to create a new timer job every time for an ItemUpdating event. Seems to be impossible to create a new timer job from this scope. Is not working even I'm using SPSecurity.RunWithElevatedPrivileges and AppPool is same as central admin AppPool.

In the end, I managed to solve my problem by using the wonderful class: SPWorkItemJobDefinition

share|improve this answer
    
In the end I gave up. The properties I need to set are set via a poweshell script. –  John Feb 14 '12 at 13:57
2  
I did managed to solve my problem by using the wonderful class: SPWorkItemJobDefinition –  Ovidiu Becheş-Puia Feb 17 '12 at 13:58
    
hi- I was checking the site for "not answer" answers and saw this one, so I edited the original text to be more fitting. Hope you don't mind. –  SPArchaeologist Dec 18 '13 at 13:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.