Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Requirement :

Web Application "A" - App-pool account : acc1 - Classic Mode Authentication

Web Application "B" - App-pool account : acc2 - Classic Mode Authentication

Web Application "C" - App-pool account : acc3 - Claims Mode Authentication + Kerberos

Create site collection in web application B from web application A programmatically (on click of a link). For creating site collection I am using selfservicecreatesite (with quota template parameter).

Permission : acc1 has full control on web app B and Web app C (through user web policy + explicit rights from database)

Exception : Site collection is getting created but exception thrown 'Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))'.

Can anyone help on it?

share|improve this question
1  
What ownerLogin are you passing in SelfServiceCreateSite? Is is the same user you're logged in when you click the site creation link? –  Jussi Palo Feb 21 '12 at 7:04
    
no its not the same user that has logged in ..... –  Monica Jagani Feb 21 '12 at 9:50

3 Answers 3

There are 5 solutions:

  1. Grant your application pool accounts appropriate rights to the configuration database.
  2. Create a custom windows service that runs as the farm account and uses .NET remoting to communicate tasks.
  3. Create a virtual application under the _layouts folder of each web application and have it run using the SCA application pool.
  4. Direct all site collection requests to an application page under the SCA site and pass in target values.
  5. Call a web service running under the SCA's _layouts folder.

For more details look here.

share|improve this answer
    
Above solution is not possible to implement in my current solution. –  Monica Jagani Feb 21 '12 at 8:30

Enable "Use Self-Service Site Creation" permission in the Web Application B's "User Permissions".

I believe the reason for acc1 not being able to access web app C is that identities are different when the authentication method for web app is different. So when you use SPRunWithElevatedPrivileges on web app 1, you will impersonate as acc1, but that acc1 isn't the same acc1 on web app 3 as it is on web app 1 due to authentication methods being different.

Someone please correct if I'm wrong.

share|improve this answer
    
"Use Self-Service Site Creation" permission is enabled. –  Monica Jagani Feb 21 '12 at 8:11
    
if the code is running from web app A and uses RunWithElevatedPrivileges (ie now code running under acc1) .can it access the resources of Web App C (i am getting access denied on it) –  Monica Jagani Feb 21 '12 at 9:52
    
i am agreeing with you on your comment. How can we over come the issue ? –  Monica Jagani Feb 21 '12 at 10:54
    
any help would be appreciated.... –  Monica Jagani Feb 22 '12 at 9:59
    
Can't really think of any feasible solution if custom web service or application under _layouts is not possible. Maybe open support case at MS, as I have a feeling there is some trick for this :/ –  Jussi Palo Feb 23 '12 at 6:52
up vote 0 down vote accepted

Well a work around for this ...apply permission on web application c via powershell and not UI. When rights are assigned using powershell , junk character does not get attached to the user name.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.