SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Any suggestions would be helpful...

I am attemting to access an external list using the Server OM. The external list is configured to use pass through credentials. The list functions perfectly in the SharePoint UI.

When I run this code in a console app:

            using (SPSite site = new SPSite(""))
                SPServiceContext context = SPServiceContext.GetContext(site);
                SPServiceContextScope contextScope = new SPServiceContextScope(context);

                using (SPWeb web = site.RootWeb)

                    SPList list = web.Lists["Industries"];
                    SPListItemCollection items = list.GetItems();
                    foreach (SPListItem item in items)


I get this error:

System.UnauthorizedAccessException was unhandled Message=Attempted to perform an unauthorized operation. Source=Microsoft.SharePoint
StackTrace: at Microsoft.SharePoint.SPListDataSource.CheckUserIsAuthorized(SPBasePermissions perms) at Microsoft.SharePoint.SPListDataSource.GetFilteredEntityInstances(XmlDocument xdQueryView, Boolean fFormatDates, Boolean fUTCToLocal, String firstRowId, Boolean fBackwardsPaging, String& bdcidFirstRow, String& bdcidNextPageRow, List1& lstColumnNames, Dictionary2& dictColumnsUsed, List1& mapRowOrdering, List1& lstEntityData) at Microsoft.SharePoint.SPListItemCollection.EnsureEntityDataViewAndOrdering(String& bdcidFirstRow, String& bdcidNextPageFirstRow) at Microsoft.SharePoint.SPListItemCollection.EnsureListItemsData() at Microsoft.SharePoint.SPListItemCollection.get_Count() at Microsoft.SharePoint.SPEntityInstanceEnumerator.System.Collections.IEnumerator.MoveNext() at TestExternalList.Program.Main(String[] args) in c:\Users\rkauche\Desktop\IT\TestExternalList\TestExternalList\Program.cs:line 28 at System.AppDomain._nExecuteAssembly(Assembly assembly, String[] args) at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly() at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state) at System.Threading.ThreadHelper.ThreadStart() InnerException:

share|improve this question

It's probably the double hop issue...

share|improve this answer
I have Kerberos auth enabled. It's not a double hop issue. – Robert Kaucher Sep 21 '12 at 14:10
While this may theoretically answer the question, and it sounds as though it does not in this case, we prefer inclusion of the essential parts of the answer. This does not help a user who is unaware of the double hop issue. See answer for general guidelines. Thanks. – SPDoctor Sep 21 '12 at 14:12
If it were the double hop issue the list would not work in the SharePoint UI. This issue seems related to the fact that the BCS datasource is using Pass Through authentication. I am attempting to work through some other problems, but I believe I have solved it. – Robert Kaucher Sep 21 '12 at 14:20
up vote 0 down vote accepted

Dmitry Kaloshin of LightningTools whose team member, Phill Duffy, created BCS Tester Man, assisted me in getting this right.

As I suspected the issue was with attempting to use Pass Through authentication on the BCS data source. I had attempted to use the Secure Store Application for impersonation but had issues with it because I had set it to individual rather than group. Once I reviewed this blog post as suggested by Dmitry Kaloshin and saw that the author had set it to "Group" I deleted all of my lists, my settings for the SSA. and started from scratch. After recreating all the settings on the SSA, ECTs, and External List it all worked like a charm.

This was not an ideal solution for me, though. I really did not want to deal with the fact that now every user interacts with the database as the Secure Store user. But I suppose that is life.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.