Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

When activating a site feature I automaticly want to set a WebApplication property. Even if a farm administrator activates the feature, the security exception is thrown ("access denied").

AFAIK SPSecurity.RunWithElevatedPrivileges runs as a site admin, not farm admin. But HOW can this be done? I tried the following codes:

SPWebServiceCollection wsc = new SPWebServiceCollection(SPFarm.Local);
            foreach (SPWebService ws in wsc)
            {
                SPWebApplicationCollection wac = ws.WebApplications;
                foreach (SPWebApplication wa in wac)
                {
                    try
                    {
                        if (wa.MaxQueryLookupFields < maxLookupFields)
                        {
                            wa.MaxQueryLookupFields = maxLookupFields;
                        }

                    }
                    catch (System.Security.SecurityException ex)
                    {
                        _log.ErrorFormat("Access denied");
                    }
                }
            }

Error at currentApplication.MaxQueryLookupFields = maxLookupFields

another attempt with same Exception:

 SPSecurity.RunWithElevatedPrivileges(delegate()
            {
                SPWeb currentWeb = ContentTypes.ValidateFeatureActivation(properties);
                using (SPSite site = new SPSite(SPContext.Current.Site.ID, SPUserToken.SystemAccount))
                {
                    SPWebApplication currentApplication = site.WebApplication;
                    if (currentApplication.MaxQueryLookupFields < newMaxValue)
                    {
                        try
                        {
                            currentApplication.MaxQueryLookupFields = newMaxValue;
                            success = currentApplication.MaxQueryLookupFields == newMaxValue;
                        }    
                        catch (System.Security.SecurityException ex)
                        {
                            _log.ErrorFormat("no permission");
                        }
                    } else
                    {
                        success = true;
                    }
                }
            });
share|improve this question

1 Answer 1

up vote 2 down vote accepted

I think that these properties are stored in Configuration Data Base. By security reason, access to this DB is limmited. This post describes how to solve this issue for self-site creation process. I think that the solution in your case will be the same.

share|improve this answer
1  
Yes, in a least privileges configuration, the App Pool account - which is what elevated privileges runs as - cannot access the configuration database, and so cannot update the web applications properties. (How it can read those properties has always been a mystery to me. –  Andy Burns May 24 '12 at 13:33
    
read and write permissions are not the same ;) –  Alexander May 24 '12 at 13:37
    
You mean on the database connection to the Config DB? Ah, that would make sense. –  Andy Burns May 24 '12 at 13:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.