2

I have a webservice (no vcf) with Windows authentication(impersonate="true"), that uses the SharePoint 2013 Object Model.

When I call a webservice method that operates on a SharePoint Web Application with NTLM authentication (created with PowerShell) all goes well.

When I call a webservice method that operates on a SharePoint Web Application with Claims authentication (created with Claims authentication type: Enable windows authentication -> Integrated Windows authentication -> NTLM) all goes well only for the user of Central Admin Application Pool.

I make my user: Farm Admin, Site Collection admin, Site Owner, ... but nothing changes.

My caller is an Active Directory user with no Kerberos authentication enabled, but all the development environment is inside a single computer.

I am new to claims authenticaion. Do I have to modify the webservice code/web.config?

I have an error when I try to get Title/Name info inside the following code:

   spsSite = New SPSite(strUrl)
   If strUrl.Equals(spsSite.Url, StringComparison.OrdinalIgnoreCase) Then
         'strTitle = spsSite.RootWeb.Title
         strTitle = spsSite.RootWeb.Name
         …
         Return 0
   End If

Inside log I can see the following (System.UnauthorizedAccessException: Access is denied):

> 05/09/2013 13:02:22.47 General                            6t8b       
> Verbose     Looking up  site http://winsrv12ign in the farm
> SharePoint_Config       05/09/2013 13:02:22.47 General                
> 6t8d        Verbose     Looking up the additional information about
> the typical site http://winsrv12ign.   05/09/2013 13:02:22.47 General 
> 6t8f        Verbose     Site lookup is replacing http://winsrv12ign
> with the alternate access url http://winsrv12ign.       05/09/2013
> 13:02:22.47 General                            6t8g        Verbose    
> Looking up typical site http://winsrv12ign:80/ in web application
> SPWebApplication Name=SharePoint - 80.  05/09/2013 13:02:22.47 General
> 6t8h        Verbose     Found typical site /
> (26e8fdd4-662b-4518-b998-10ffba370941) in web application
> SPWebApplication Name=SharePoint - 80.        05/09/2013 13:02:22.47
> General                            narq        Verbose     Releasing
> SPRequest with allocation Id {CD815621-4839-49A7-B461-B4D5E2CB4E16}   
> 05/09/2013 13:02:22.47 Upgrade                            ajyiy      
> Verbose     05/09/2013 13:02:22.47 w3wp (0x0EAC) 0x1A54 SharePoint
> Foundation Upgrade SPManager ajyiy VERBOSE Using cached
> [SPContentDatabase Name=WSS_Content] NeedsUpgrade value: False.
> 00000000-0000-0000-0000-000000000000        05/09/2013 13:02:22.47
> Upgrade                            ajyix       Verbose     05/09/2013
> 13:02:22.47 w3wp (0x0EAC) 0x1A54 SharePoint Foundation Upgrade
> SPManager ajyix VERBOSE Using cached [SPContentDatabase
> Name=WSS_Content] IsBackwardsCompatible value: True.
> 00000000-0000-0000-0000-000000000000   05/09/2013 13:02:22.47 Database
> tzku        Verbose             ConnectionString: 'Data
> Source=WINSRV12IGN;Initial Catalog=SharePoint_Config;Integrated
> Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool
> Size=100;Connect Timeout=15'    Partition: NULL ConnectionState:
> Closed ConnectionTimeout: 15       05/09/2013 13:02:22.47 Database    
> ahjqp       Verbose     SQL connection time: 0.261555588768964 
> 05/09/2013 13:02:22.48 Monitoring                         nasq       
> Verbose     Entering monitored scope (SPSqlClient). Parent No       
> 05/09/2013 13:02:22.48 Database                           tkeb       
> Verbose     Setting database session for
> dcb25be4-2aff-4013-be82-f70843083df3 and site
> 26e8fdd4-662b-4518-b998-10ffba370941.   05/09/2013 13:02:22.48
> Database                           tzku        Verbose            
> ConnectionString: 'Data Source=WINSRV12IGN;Initial
> Catalog=WSS_Content;Integrated
> Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool
> Size=100;Connect Timeout=15'    Partition:
> 26e8fdd4-662b-4518-b998-10ffba370941 ConnectionState: Closed
> ConnectionTimeout: 15  05/09/2013 13:02:22.48 Database                
> ahjqp       Verbose     SQL connection time: 0.216228598886171 
> 05/09/2013 13:02:22.49 Monitoring                         nasq       
> Verbose     Entering monitored scope (SPSqlClient). Parent SPSqlClient
> 05/09/2013 13:02:22.49 Database                           tkeb       
> Verbose     Setting database session for
> dcb25be4-2aff-4013-be82-f70843083df3 and site
> 26e8fdd4-662b-4518-b998-10ffba370941.   05/09/2013 13:02:22.49
> Database                           tzku        Verbose            
> ConnectionString: 'Data Source=WINSRV12IGN;Initial
> Catalog=WSS_Content;Integrated
> Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool
> Size=100;Connect Timeout=15'    Partition:
> 26e8fdd4-662b-4518-b998-10ffba370941 ConnectionState: Closed
> ConnectionTimeout: 15  05/09/2013 13:02:22.49 Database                
> ahjqp       Verbose     SQL connection time: 0.0911428687165548       
> 05/09/2013 13:02:22.49 Monitoring                         b4ly       
> Verbose     Leaving Monitored Scope (SPSqlClient). Execution
> Time=4,28762594128583          05/09/2013 13:02:22.49 Monitoring      
> nass        Verbose             ____Execution Time=4,28762594128583   
> 05/09/2013 13:02:22.49 Monitoring                         nass       
> Verbose     ____CPU Cycles=5328288           05/09/2013 13:02:22.49
> General                            8xfr        Verbose            
> PermissionMask check failed. asking for 0x08000000, have 0x00000000   
> 05/09/2013 13:02:22.50 Monitoring                         b4ly       
> Verbose     Leaving Monitored Scope (SPSqlClient). Execution
> Time=15,3333035343878          05/09/2013 13:02:22.50 Monitoring      
> nass        Verbose             ____Execution Time=15,3333035343878   
> 05/09/2013 13:02:22.50 Monitoring                         nass       
> Verbose     ____CPU Cycles=22067409          05/09/2013 13:02:22.50
> General                            8xfr        Verbose            
> **PermissionMask check failed. asking for 0x2000010000, have 0x00000000** 
> 05/09/2013 13:02:22.50 General                            8e2s       
> Medium      Unknown SPRequest error occurred. More information:
> 0x80070005      05/09/2013 13:02:22.50 General                        
> aix9j       High                SPRequest.OpenWeb: UserPrincipalName=,
> AppPrincipalName= ,bstrUrl=http://winsrv12ign           05/09/2013
> 13:02:22.50 General                            ai1wu       Medium     
> **System.UnauthorizedAccessException: Access is denied.** (Exception from
> HRESULT: 0x80070005 (E_ACCESSDENIED)), StackTrace:    at
> Microsoft.SharePoint.SPWeb.InitWeb()     at
> Microsoft.SharePoint.SPWeb.get_Name()     at
> itConsult.ItcFramework.ItcSharePoint2013.SPSManager.iSPObjFromUrl(String
> strUrl, String& strTitle, SPObjType& esotSPObjctType, Int32&
> iIconInfo, String& strListType)     at
> itConsult.ItcFramework.ItcSharePoint2013.SPSManager.WebAppl_iSplitUrl(String
> strSPSBaseUrl, String strUrl, DataTable& dtUrlInfo, String& strErrors)
> at
> itConsult.ItcFramework.ItcSharePoint2013.SPSManager.WebAppl_iBaseUrlListSplitUrl(String[]
> astrSPSBaseUrls, String strUrl, DataTable& dtUrlInfo, String&
> strErrors)     at
> itConsult.josh.SPSWebService.SPSWebService.WebAppl_iBaseUrlListSplitUrl(String[]
> astrS...      05/09/2013 13:02:22.50 General                          
> ai1wu       Medium              ...PSBaseUrls, String strUrl,
> DataTable& dtUrlInfo)     at
> System.RuntimeMethodHandle.InvokeMethod(Object target, Object[]
> arguments, Signature sig, Boolean constructor)     at
> System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj,
> Object[] parameters, Object[] arguments)     at
> System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags
> invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)  
> at System.Web.Services.Protocols.LogicalMethodInfo.Invoke(Object
> target, Object[] values)     at
> System.Web.Services.Protocols.WebServiceHandler.Invoke()     at
> System.Web.Services.Protocols.WebServiceHandler.CoreProcessRequest()  
> at
> System.Web.Services.Protocols.SyncSessionlessHandler.ProcessRequest(HttpContext
> context)     at System.Web.Script.Services.ScriptHa...       
> 05/09/2013 13:02:22.50 General                            ai1wu      
> Medium             
> ...ndlerFactory.HandlerWrapper.ProcessRequest(HttpContext context)    
> at
> System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
> at System.Web.HttpApplication.ExecuteStep(IExecutionStep step,
> Boolean& completedSynchronously)     at
> System.Web.HttpApplication.ApplicationStepManager.ResumeSteps(Exception
> error)     at
> System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext
> context, AsyncCallback cb, Object extraData)     at
> System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)   
> at System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr ecb, Int32
> iWRType)       05/09/2013 13:02:22.50 General                         
> ftd0        Medium      Access Denied. Exception: Access is denied.
> (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)), StackTrace:  
> at Microsoft.SharePoint.Library.SPRequestInternalClass.OpenWeb(String
> bstrUrl, String& pbstrServerRelativeUrl, String& pbstrTitle, String&
> pbstrDescription, String& pbstrTitleResourceId, String&
> pbstrDescriptionResourceId, Guid& pguidID, DateTime& pdtTimeCreated,
> String& pbstrRequestAccessEmail, UInt32& pwebVersion, Guid&
> pguidScopeId, UInt32& pnAuthorID, UInt32& pnLanguage, UInt32&
> pnLocale, UInt16& pnTimeZone, Boolean& bTime24, Int16& pnCollation,
> UInt32& pnCollationLCID, Int16& pnCalendarType, Int16&
> pnAdjustHijriDays, Int16& pnAltCalendarType, Boolean& pbShowWeeks,
> Int16& pnFirstWeekOfYear, UInt32& pnFirstDayOfWeek, Int16& pnWorkDays,
> Int16& pnWorkDayStartHour, Int16& pnWork...          05/09/2013
> 13:02:22.50 General                            ftd0        Medium     
> ...DayEndHour, Int16& pnMeetingCount, Int32& plFlags, Boolean&
> bConnectedToPortal, String& pbstrPortalUrl, String& pbstrPortalName,
> Int32& plWebTemplateId, Int16& pnProvisionConfig, String&
> pbstrDefaultTheme, String& pbstrDefaultThemeCSSUrl, String&
> pbstrThemedCssFolderUrl, String& pbstrAlternateCSSUrl, String&
> pbstrCustomizedCssFileList, String& pbstrCustomJSUrl, String&
> pbstrAlternateHeaderUrl, String& pbstrMasterUrl, String&
> pbstrCustomMasterUrl, String& pbstrSiteLogoUrl, String&
> pbstrSiteLogoDescription, Object& pvarUser, Boolean& pvarIsAuditor,
> UInt64& ppermMask, Boolean& bUserIsSiteAdmin, Boolean& bHasUniquePerm,
> Guid& pguidUserInfoListID, Guid& pguidUniqueNavParent, Int32&
> plSiteFlags, DateTime& pdtLastContentChange, DateTime&
> pdtLastSecurityChange, String& pbstrWelcomePage, Boolean& p...        
> 05/09/2013 13:02:22.50 General                            ftd0       
> Medium              ...bOverwriteMUICultures, Boolean& pbMUIEnabled,
> String& pbstrAlternateMUICultures, Int32& plSiteSchemaMajorVersion,
> Int32& plSiteSchemaMinorVersion, Int32& plSiteSchemaBuildVersion,
> Int32& plSiteSchemaRevisionVersion, Int32& puiVersion, Int16&
> pnClientTag, Boolean& pfIsEvalSite, Guid& pgSourceSiteId, DateTime&
> pdtExpirationDate, Guid& pgEvalSiteId, Guid& pguidAppProductId,
> String& pbstrRemoteAppUrl, String& pbstrOAuthAppId, String&
> pbstrAppDatabaseName, Guid& pgAppDatabaseServerReferenceId, String&
> pbstrAppDatabaseTargetApplicationId, String& pbstrAppWebDomainId,
> Int32& plUpgradeFlags, DateTime& pdtReminderDate, UInt64& pmaskDeny)  
> at Microsoft.SharePoint.Library.SPRequest.OpenWeb(String bstrUrl,
> String& pbstrServerRelativeUrl, String& pbstrTitle, String&
> pbstrDescription, String& pbstrTi...       05/09/2013 13:02:22.50
> General                            ftd0        Medium             
> ...tleResourceId, String& pbstrDescriptionResourceId, Guid& pguidID,
> DateTime& pdtTimeCreated, String& pbstrRequestAccessEmail, UInt32&
> pwebVersion, Guid& pguidScopeId, UInt32& pnAuthorID, UInt32&
> pnLanguage, UInt32& pnLocale, UInt16& pnTimeZone, Boolean& bTime24,
> Int16& pnCollation, UInt32& pnCollationLCID, Int16& pnCalendarType,
> Int16& pnAdjustHijriDays, Int16& pnAltCalendarType, Boolean&
> pbShowWeeks, Int16& pnFirstWeekOfYear, UInt32& pnFirstDayOfWeek,
> Int16& pnWorkDays, Int16& pnWorkDayStartHour, Int16& pnWorkDayEndHour,
> Int16& pnMeetingCount, Int32& plFlags, Boolean& bConnectedToPortal,
> String& pbstrPortalUrl, String& pbstrPortalName, Int32&
> plWebTemplateId, Int16& pnProvisionConfig, String& pbstrDefaultTheme,
> String& pbstrDefaultThemeCSSUrl, String& pbstrThemedCssFolderUrl,
> String& pbstr...          05/09/2013 13:02:22.50 General              
> ftd0        Medium              ...AlternateCSSUrl, String&
> pbstrCustomizedCssFileList, String& pbstrCustomJSUrl, String&
> pbstrAlternateHeaderUrl, String& pbstrMasterUrl, String&
> pbstrCustomMasterUrl, String& pbstrSiteLogoUrl, String&
> pbstrSiteLogoDescription, Object& pvarUser, Boolean& pvarIsAuditor,
> UInt64& ppermMask, Boolean& bUserIsSiteAdmin, Boolean& bHasUniquePerm,
> Guid& pguidUserInfoListID, Guid& pguidUniqueNavParent, Int32&
> plSiteFlags, DateTime& pdtLastContentChange, DateTime&
> pdtLastSecurityChange, String& pbstrWelcomePage, Boolean&
> pbOverwriteMUICultures, Boolean& pbMUIEnabled, String&
> pbstrAlternateMUICultures, Int32& plSiteSchemaMajorVersion, Int32&
> plSiteSchemaMinorVersion, Int32& plSiteSchemaBuildVersion, Int32&
> plSiteSchemaRevisionVersion, Int32& puiVersion, Int16& pnClientTag,
> Boolean& pfIsEvalSite, Guid& p...      05/09/2013 13:02:22.50 General 
> ftd0        Medium              ...gSourceSiteId, DateTime&
> pdtExpirationDate, Guid& pgEvalSiteId, Guid& pguidAppProductId,
> String& pbstrRemoteAppUrl, String& pbstrOAuthAppId, String&
> pbstrAppDatabaseName, Guid& pgAppDatabaseServerReferenceId, String&
> pbstrAppDatabaseTargetApplicationId, String& pbstrAppWebDomainId,
> Int32& plUpgradeFlags, DateTime& pdtReminderDate, UInt64& pmaskDeny). 
> 05/09/2013 13:02:22.50 General                            6t8b       
> Verbose     Looking up context  site
> http://winsrv12ign:990/SPSWebService.asmx in the farm
> SharePoint_Config          05/09/2013 13:02:22.50 General             
> 88gr        Verbose             alternateUrl is null     05/09/2013
> 13:02:22.50 Database                           tzku        Verbose    
> ConnectionString: 'Data Source=WINSRV12IGN;Initial
> Catalog=SharePoint_Config;Integrated
> Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool
> Size=100;Connect Timeout=15'    Partition: NULL ConnectionState:
> Closed ConnectionTimeout: 15       05/09/2013 13:02:22.50 Database    
> ahjqp       Verbose     SQL connection time: 0.172368275856289 
> 05/09/2013 13:02:22.50 General                            adyrv      
> High        Cannot find site lookup info for request Uri
> http://winsrv12ign:990/SPSWebService.asmx.   05/09/2013 13:02:22.50
> Topology                           88gs        Verbose            
> hostHeaderSiteInfo is null          05/09/2013 13:02:22.50 General    
> 88gr        Verbose             alternateUrl is null     05/09/2013
> 13:02:22.51 Database                           tzku        Verbose    
> ConnectionString: 'Data Source=WINSRV12IGN;Initial
> Catalog=SharePoint_Config;Integrated
> Security=True;Enlist=False;Pooling=True;Min Pool Size=0;Max Pool
> Size=100;Connect Timeout=15'    Partition: NULL ConnectionState:
> Closed ConnectionTimeout: 15       05/09/2013 13:02:22.51 Database    
> ahjqp       Verbose     SQL connection time: 0.116495252888286 
> 05/09/2013 13:02:22.51 General                            adyrv      
> High        Cannot find site lookup info for request Uri
> http://winsrv12ign:990/SPSWebService.asmx.   05/09/2013 13:02:22.51
> Topology                           88gs        Verbose            
> hostHeaderSiteInfo is null          05/09/2013 13:02:22.51 General    
> af32w       Unexpected  Could not load SPIisSettings for
> http://winsrv12ign:990/SPSWebService.asmx.       05/09/2013
> 13:02:22.51 General                            narq        Verbose    
> Releasing SPRequest with allocation Id
> {7BD65E26-2089-43D1-90BB-59EE4A394F93}

1 Answer 1

1

Can you try out claims/kerberos? Neither classic/ntlm nor claims/ntlm supports delegation. Potentially this is causing the access denied.

Also check out this post: Is Classic/NTLM based authentication a security riskfor Internet facing sites?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.