We have a custom service application set-up which is tasked with the creation of site collections. It uses the blank site template for this, on which we want to activate several of the out of the box features to enable certain functionality. When we try to do so, a "Access is denied" error is thrown.
We analyzed the stack trace and the culprit seems to be the out of the box TaxonomyField feature which is required to have taxonomy fields. That feature seems to have feature event receiver code which contains a call to RunWithElevatedPrivileges. For some reason, the code inside of that block is getting an access denied on the point where it is accessing the properties of an SPWeb object.
We already tried to give the service account of the service application permissions on different levels (site collection admin, web application full control), but that does not seem to work apart from db_owner permissions on the database which doesn't seem like a good idea.
Outer Exception:
Stacktrace:
at System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
at Microsoft.SharePoint.SPFieldCollection.CreateNewFieldInternal(String typeName, String displayName)
at Microsoft.SharePoint.Taxonomy.TaxonomyFeatureReceiver.CreateFields(SPSite site)
at Microsoft.SharePoint.Taxonomy.TaxonomyFeatureReceiver.FeatureActivated(SPFeatureReceiverProperties properties)
at Microsoft.SharePoint.SPFeature.DoActivationCallout(Boolean fActivate, Boolean fForce)
at Microsoft.SharePoint.SPFeature.Activate(SPSite siteParent, SPWeb webParent, SPFeaturePropertyCollection props, SPFeatureActivateFlags activateFlags, Boolean fForce)
at Microsoft.SharePoint.SPFeatureCollection.AddInternal(SPFeatureDefinition featdef, Version version, SPFeaturePropertyCollection properties, SPFeatureActivateFlags activateFlags, Boolean force, Boolean fMarkOnly)
at Microsoft.SharePoint.SPTemplateAssociationElement.EnsureTemplateAssociatedSiteFeaturesActivated(SPSite site, String sTemplateName)
at Microsoft.SharePoint.SPFeatureManager.<>c__DisplayClass16.<EnsureTemplateAssociatedSiteFeaturesActivated>b__15()
at Microsoft.SharePoint.SPSecurity.RunAsUser(SPUserToken userToken, Boolean bResetContext, WaitCallback code, Object param)
at Microsoft.SharePoint.SPFeatureManager.EnsureTemplateAssociatedSiteFeaturesActivated(Byte[]& userToken, Guid& tranLockerId, Int32 nZone, Guid databaseid, Guid siteid, String sTemplateName)
at Microsoft.SharePoint.Library.SPRequestInternalClass.ApplyWebTemplate(String bstrUrl, String bstrWebTemplateContent, Int32 fWebTemplateContentFromSubweb, Int32 fDeleteGlobalListsWithWebTemplateContent, String& bstrWebTemplate, Int32& plWebTemplateId)
at Microsoft.SharePoint.Library.SPRequest.ApplyWebTemplate(String bstrUrl, String bstrWebTemplateContent, Int32 fWebTemplateContentFromSubweb, Int32 fDeleteGlobalListsWithWebTemplateContent, String& bstrWebTemplate, Int32& plWebTemplateId)
at Microsoft.SharePoint.SPWeb.ApplyWebTemplate(String strWebTemplate)
at Microsoft.SharePoint.Administration.SPSiteCollection.Add(SPContentDatabase database, SPSiteSubscription siteSubscription, String siteUrl, String title, String description, UInt32 nLCID, String webTemplate, String ownerLogin, String ownerName, String ownerEmail, String secondaryContactLogin, String secondaryContactName, String secondaryContactEmail, String quotaTemplate, String sscRootWebUrl, Boolean useHostHeaderAsSiteName)
at Microsoft.SharePoint.Administration.SPSiteCollection.Add(SPSiteSubscription siteSubscription, String siteUrl, String title, String description, UInt32 nLCID, String webTemplate, String ownerLogin, String ownerName, String ownerEmail, String secondaryContactLogin, String secondaryContactName, String secondaryContactEmail, Boolean useHostHeaderAsSiteName)
at Microsoft.SharePoint.Administration.SPSiteCollection.Add(String siteUrl, String title, String description, UInt32 nLCID, String webTemplate, String ownerLogin, String ownerName, String ownerEmail, String secondaryContactLogin, String secondaryContactName, String secondaryContactEmail)
at SPMeta2.SSOM.ModelHandlers.SiteModelHandler.DeploySite(WebApplicationModelHost webAppModelHost, SPWebApplication webApp, SiteDefinition siteModel)
at SPMeta2.SSOM.ModelHandlers.SiteModelHandler.DeployModel(Object modelHost, DefinitionBase model)
at SPMeta2.Services.ModelServiceBase.ProcessModelDeployment(Object modelHost, ModelNode modelNode)
at SPMeta2.Services.ModelServiceBase.DeployModel(ModelHostBase modelHost, ModelNode model)
at SPMeta2.SSOM.Services.SSOMProvisionService.DeployModel(ModelHostBase modelHost, ModelNode model)
at Contoso.Project.ServiceAPI.Entity.EntityProvisioner.CreateSite(SPWebApplication webApplication, String url, String name, String ownerLogin, String secondaryContactLogin, String databaseName)
at Contoso.Project.ServiceAPI.Entity.EntityProvisioner.Provision()
Inner Exception 0:
Exception: System.UnauthorizedAccessException
Message:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Stacktrace:
at Microsoft.SharePoint.Library.SPRequest.GetWebMetainfo(String bstrUrl)
at Microsoft.SharePoint.SPWeb.GetProperties()
at Microsoft.SharePoint.Utilities.SPPropertyBag..ctor(GetProperties getProperties, UpdateProperties updateProperties)
at Microsoft.SharePoint.SPWeb.get_Properties()
at Microsoft.SharePoint.Taxonomy.TaxonomyField.GetLookupListId(SPSite site)
at Microsoft.SharePoint.Taxonomy.TaxonomyField.<>c__DisplayClassa.<Initialize>b__8()
at Microsoft.SharePoint.SPSecurity.<>c__DisplayClass4.<RunWithElevatedPrivileges>b__2()
at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(WaitCallback secureCode, Object param)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode)
at Microsoft.SharePoint.Taxonomy.TaxonomyField.Initialize(SPFieldCollection fields)
at Microsoft.SharePoint.Taxonomy.TaxonomyField..ctor(SPFieldCollection fields, String typeName, String displayName)
So what would be the most likely place where we lack permissions?
