1

I changed the IIS pool identity service account for my SharePoint 2010 web application thus replacing the default "Network Service" account (using SharePoint Administrator.) The pool service account permissions are now as documented by MS here in the "Application pool account" section: http://technet.microsoft.com/en-us/library/cc678863%28v=office.14%29.aspx

Elevated code in my feature fails when attempting to activate additional site features with the following exception:

Exception while creating the site: The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again. Stack Trace: at Microsoft.SharePoint.SPGlobal.HandleComException(COMException comEx) at Microsoft.SharePoint.Library.SPRequest.ValidateFormDigest(String bstrUrl, String bstrListName) at Microsoft.SharePoint.SPWeb.ValidateFormDigest() at Microsoft.SharePoint.SPSecurity.ValidateSecurityOnOperation(SPOperationCode code, SPSecurableObject obj) at Microsoft.SharePoint.SPFeature.AddRowToFeaturesTable(SPFeaturePropertyCollection props, SPSite site, SPWeb web, Boolean fForce) at Microsoft.SharePoint.SPFeature.Activate(SPSite siteParent, SPWeb webParent, SPFeaturePropertyCollection props, SPFeatureActivateFlags activateFlags, Boolean fForce) at Microsoft.SharePoint.SPFeatureCollection.AddInternal(SPFeatureDefinition featdef, Version version, SPFeaturePropertyCollection properties, SPFeatureActivateFlags activateFlags, Boolean force, Boolean fMarkOnly) at Microsoft.SharePoint.SPFeatureCollection.AddInternalWithName(Guid featureId, String featureName, Version version, SPFeaturePropertyCollection properties, SPFeatureActivateFlags activateFlags, Boolean force, Boolean fMarkOnly, SPFeatureDefinitionScope featdefScope) at Microsoft.SharePoint.SPFeatureCollection.Add(Guid featureId)
at MySite.<>c__DisplayClass2.b__0()
at Microsoft.SharePoint.SPSecurity.<>c__DisplayClass4.b__2()
at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(WaitCallback secureCode, Object param)
at Microsoft.SharePoint.SPSecurity.RunWithElevatedPrivileges(CodeToRunElevated secureCode)
at MySite.ActivateWebFeature(String targetWebUrl, Guid featureId)
at MySite.CreateSubsite(String subsitePath, String titleEng, String descEng, String titleFre, String descFre, Boolean inheritPermissions)

What other permissions does the pool identity user need to have to run elevated code properly? Is it a security risk if I set the pool identity to my farm account (like owstimer service)? (If yes, why?)

  • 1
    Use SPUtility.ValidateFormDigest() or check if the SPWeb object has AllowUnsafeUpdates=true before updating it – ReTech Aug 11 '14 at 20:04
  • add the app pool account into the policy of web app of the web application. check this mssharepointtips.com/tip.asp?id=979 – Waqas Sarwar MVP Aug 11 '14 at 21:30
  • @ReTech Adding AllowUnsafeUpdates=true in my elevated method worked. No need to make pool identity my farm admin. Thank You! Is it possible to mark comments as answers here? – user584572 Aug 11 '14 at 21:44
  • Nice to hear that I could help you :) unfortunately you can't mark a comment as answer – ReTech Aug 17 '14 at 22:06
0

No need to give more freedom to the app pool identity for the SP web application. SPWeb object needed to have AllowUnsafeUpdates=true in the elevated code section. This comment by ReTech resolved my issue:

"Use SPUtility.ValidateFormDigest() or check if the SPWeb object has AllowUnsafeUpdates=true before updating it – ReTech 19 hours ago"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.