SPPersitedObject

Question

Hi i am having some problems updating SPPersitedObjects

Enviroment A

userA site owner account no central admin permissions userB Sharepoint Installation Account permissions on everything development environment on my laptop, so everything runs locally of the same machine

Environment B

User A Farm Administrator

Database server and SharePoint Server each running on separate machines.

$contentService.RemoteAdministratorAccessDenied = false

has been applied on both servers

Code Snippet

   public void ApplySettings(object sender, EventArgs e)
    {
        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            if (AssetDepreciatorProps.Visible)
            {
                settingsAsset.AssetListName = AssetListNametxt.Text;
                settingsAsset.DepreciationListLogName = DepreciationListLogNametxt.Text;
                settingsAsset.siteName = siteNameAssetTxt.Text;
                settingsAsset.Update();
            }
            else
            {
                settings.siteName = siteNametxt.Text;
                settings.CurrentContractsListName = CurrentContractsListNametxt.Text;
                settings.ExpiredContractsListName = ExpiredContractsListNametxt.Text;
                settings.Update();
            }
        });
    }

environment A Test i can run this piece of code with userA and it works no problem. important to note this user has absolutely no permissions anywhere else except for the site collection of which he has full control

environment B Test

code throws the following exception with User A

the SPPersistedObject, ContractsTimerJobPersistedObject Name=ContractManagementTimerJobSettings, could not be updated because the current user is not a Farm Administrator.

important to note the user is in farm administrators group and site collection owner.

the only difference i can think of is the way that SharePoint has been setup in the environments.

any ideas on how i can get this working in environment b

i think the fact that userA in environmentA can run the code might give some clues, to get it working on enviromentB

Answer 1

I would suggest that the problem is that you're in an elevated privileges block. The "user" within this block will be the content app pool account (the account used by that app pool in IIS), not User A.

It's pretty common in least privilege configured farms for the content app pool account(s) to not have the right to update the configuration database. This would result in an exception.

Possible options to resolve - if you can, set your settings within Central Admin (it's app pool MUST have right to update the config database).

Alternatively, use a timer job to process the changes you need to make. The SPWorkItemJobDefinition can be a good place to start with this.

Finally, you could grant rights on the configuration database to your app pool account, but I wouldn't recommend that.

FWIW, I've seen this catch developers out many, many times. Their dev system grants config DB access to the content app pool, but when the code is deployed onto the production system, it fails due to least privilege configuration.