Hot answers tagged

11

It depends on what you need to do. RunWithElevated only runs as the Application Pool Identity, so you might not have access to other web applications, only other site collections in the current web application, but you can be guaranteed that you will be running as a user that exists (the AppPool identity). With UserToken, you need to be sure that the user ...


7

You should use SPSite constructor override for this purpose. The code will look something like this: SPUser user = // grab the SPUser object somewhere using (SPSite site = new SPSite("http://localhost", user.UserToken)) { using (SPWeb web = site.OpenWeb()) { // do whatever you need here } } This will work in Foundation, too.


6

Our solution was to go to SP Central Admin > System Settings > Services on Server and start the "Claims to Windows Token Service". We also found this error in the logs which helped lead us to this as the solution: SPSecurityContext.WindowsIdentity: Could not retrieve a valid windows identity for NTName='PRMM-SP\polyadmin', ...


4

SPWeb.Users.GetByEmail() and SPWeb.Users.GetById() is only going to return the users that have logged in to your site. Try the method SPWeb.EnsureUser(). MSDN says the following: Checks whether the specified logon name belongs to a valid user of the website, and if the logon name does not already exist, adds it to the website.


4

Try adding: _WebClient.Credentials = CredentialCache.DefaultCredentials;


3

When you impersonate, you need to recreate the SharePoint objects that you are working under the context of the impersonator. For example, if you are impersonating the System User using RunWithElevatedPrivileges, you can use the code below to recreate some of the SharePoint objects that you may need to manipulate: public override void ...


3

customer.Collaboration.Provisioning.SPI.EventReceivers.ProjectProvisioningEventReceiver.ProjectProvisioningEventReceiver.ItemAdded(SPItemEventProperties properties) This means that your ItemAdded Receiver for ProjectProvisioning feature fails. It will report site creation as failed because it rolls back and throws an exception. Take out all custom ...


3

Kerberos and NTLM will not allow this though it could be done via Forms authentication but you would have to write your own provider and install your own "back door" to enable this behavior. It could also possibly be done via Claims authentication. However, doing something like this pretty much violates every security standard out there. I can understand ...


2

Assuming SP2010 here... As far as I know no one other than a Site Collection Admin can delete a SP Group. I know it says the Group Owner can delete the group in the UI when you create a group, but I think that's either a mis-print or the assumption is the Group Owner will be a Site Collection Owner. If you look at the privileges associated with Full ...


2

We have touched on this subject several times before. Last time i linked to Keth Dalbys explanation on SO http://stackoverflow.com/questions/1525953/sharepoint-2007-runwithelevatedprivileges-pitfalls-of-using-this Which explains why you sould not use RWEP but in very specific situations, like when fetching data outside of SharePoint.


2

This is due to the double-hop issue. You cannot inherit the user credentials all the way to your database by using NTLM. You have several options though: User Kerberos and delegation Impersonation Use specific db-credentials (optionally using the SSO service) Use SQL login instead of Windows login and specify the credentials in the connection string and ...


2

Yes, you can use the RunWithElevatedPrivileges method, if you haven't tried it yet.


2

It sounds as though need to go into your Business Data Connectivity Service Application, and set the permissions on the object. First, go to Central Administration->Application Management->Manage service applications. Find your Business Data Connectivity service application and go to the Manage page. Select the external content type and go to Set Permissions ...


2

I use UserProfile to access this type of data. http://msdn.microsoft.com/en-us/library/microsoft.office.server.userprofiles.userprofile.aspx here's some sample code of using it with people picker private UserProfile GetExistingEmployee(string CurrentWebSiteURL) { UserProfile profile = null; using (SPSite site = new SPSite(CurrentWebSiteURL)) { ...


2

You have two main options: Give the AppPool access to the database and run your database code inside SPSecurity.RunWithElevatedPrivileges Use Windows impersonation LogonUser around your database code. See section 3. Using Win32 API in Impersonation in SharePoint : An Extreme Overview. The big question is then where to store the username/password. It can ...


2

_ Hi Bernd My draft post became over 2 pages, so I decided to cut some details, to get any replies at all. I have tried AllowNtlm = false, but for some reason I get the error message "The remote server did not satisfy the mutual authentication requirement." when I run. In IIS-Manager on the IIS-app I have only "Windows Authentication" and ...


2

In SharePoint 2010, the Welcome Control (Top right, click on your name) has an option to "Sign in as Different User" I recommend setting up fictitious user accounts in each role and using them.


2

You can't quite impersonate over REST API since the code runs client-side and any user could capture the request and use it maliciously to impersonate the user for other operations. If you have a High-Trust (Provider Hosted) App SharePoint trusts who your signed token claims the user is, but even then, you shouldn't use it client side. You might try using ...


2

The short answer is that Office and SharePoint do not share the same context in IE and thus, do not share the same credentials. All office apps open up a new instance of Internet Explorer internally and then connect to the SharePoint site using that. If the site is such that it can pass windows/domain credentials (i.e. it is listed as in the Intranet Zone) ...


1

You can update the Modified, Created, Author and Editor with the actual user and time and then call SPListItem.SystemUpdate instead of SPListItem.Update. This way time stamps and actual user information will be preserved. SPListItem.SystemUpdate Updates the database with changes that are made to the list item without changing the Modified or Modified By ...


1

Is this code running on the SharePoint server? If so try using the default SharePoint API and the runwithelevatedpriviledges rather than an impersonator and clientcontext. http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.runwithelevatedprivileges.aspx


1

If what you really need is adding a dropdown menu with values coming from a given query/data source, then I think the easier thing you can do is editing the initiation form in InfoPath. I would try this: in SPD, declare a new initiation form parameter of type single line of text or number, depending of the data type you need to get back once a choice has ...


1

Can you try following, I have just kept new SPSite and SPWeb object outside RunWithElevatedPrivileges string siteStr = "http://mywebSiteUrl/"; SPUserToken userToken; SPSecurity.RunWithElevatedPrivileges(delegate() { using (SPSite site = new SPSite(siteStr)) { using (SPWeb web = site.OpenWeb()) { userToken = web.AllUsers[4].UserToken; ...


1

If all you are doing is updating content in SharePoint, then it is better to impersonate the system account instead of elevating privilege. http://www.schaeflein.net/impersonation-and-elevation-of-privilege/ Also, even though your first scenario happens to work, you should validate the token before creating the new SPSite context.


1

If your sql server hosts on another server than sharepoint and you use NTLM-authentication you've got a problem called double hop: http://blogs.msdn.com/b/knowledgecast/archive/2007/01/31/the-double-hop-problem.aspx To workaround it use Secure Store.


1

I believe you've already asked this question: Please see link Get single user from multiple domain problem


1

Reading Technet and other sources it appears to be a well know issue. The suggestion I can give to who is in my same problem is to implement a Custom Security trimmer: use the token to access file is working, only pass it to the claim is not. So if you do a thing like: Loop with SPRunWithElevatedPrivileges Collect all results Open a Site with User Token ...


1

I think we found the issue. It is caused by the workflow itself, because the workflow fires on item change and on item create. The item is changed within the worklfow and causes a recursion. I found this article (which is for 2007) which describes it in detail. However, it is strange that it worked sometimes and sometimes not. Maybe a timing issue somewhere. ...


1

One can use conditions inside Impersonation steps, but you can't run whole impersonation step under a condition. The only pitfall is the it runs under the identity of the workflow publisher, so whichever account you are using to publish the workflow, it should have necessary rights to performs all the permissions related operations in Impersonation step It ...


1

Asside from logging on as them (which I do not recommend) you could create a test user and assign it the same permissions. I should mention that there are many good free screen sharing tools available now. One of them is SharedView by Microsoft. These will allow you to see the user's exact desktop as you talk with them.



Only top voted, non community-wiki answers of a minimum length are eligible