Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am working with an existing SharePoint deployment that has a convoluted security structure. After cleaning up permissions a bit, an approval workflow for absence requests is somehow not working for normal users. If a user with full control fills out a request, the workflow runs normally. However, if a user with Read & Add Only access generates one, the workflow fails with an "Access Denied" entry in the history.

I'm 99% sure that this is a permissions issue. All lists (workflow history and tasks included) have the same permissons now as indicated above. The System Account (the account the history entries are stamped with) has Limited Access permissons only but I wouldn't think that even a Full Control user would work if the problem was there. What other resources does workflow touch that might cause this?

Description: The workflow could not update the item, possibly because one or more columns for the item require a different type of information.
share|improve this question
    
Is this workflow UI constructed or is it programmed? Judged by the error, some of the columns doesn't seem to receive the correct type of data. Like trying to put a string into a numbers only field. –  Daniel Ziga Jul 2 '12 at 18:14
    
The workflow calls for the Title column (single line of text) to be populated with the contents of a People Picker field formatted as Display Name. Title column is set to optional in the content type. –  Toadmyster Jul 2 '12 at 21:22
    
Ah. It appears that a workflow operates (at least on list items) under the credentials of the user who initiated it. Does that sound right? When I remove Add Only and add Contribute it works fine. –  Toadmyster Jul 2 '12 at 22:11
    
Visual Studio based workflow will run under the System Account and SharePoint Designer based workflow will run under the person who triggers it but you can elevate the step by using Impersonation –  Agamand The True Jul 3 '12 at 8:03
    
Thanks, Agamand. I found this link on this thread to verify. I will have to look up how to impersonate. –  Toadmyster Jul 3 '12 at 23:07
add comment

1 Answer 1

Run it with elevated privileges like this:

SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite site = new SPSite(baseUrl))
    {
        using (SPWeb web = site.OpenWeb())
        {
            SPList list = web.Lists["Documents"];
            Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager wsm = new Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager(web);
            Microsoft.SharePoint.WorkflowServices.WorkflowInstanceService service = wsm.GetWorkflowInstanceService();

            //note:  There can be only 1 running workflow per item
            var instances = service.EnumerateInstancesForListItem(gPageList, pageID);
            foreach (var instance in instances)
            {
                if (instance.Id == gWorkflowInstanceId)
                {
                    service.CancelWorkflow(instance);
                    break;
                }
            }
        }                   
    }
}); 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.