Setting an SPSite to read-only from Application Page

Question

We are trying to make a site read-only from the code-behind of an application page.

When executing the code-snippet from a timer job or a console application it works perfectly, but it throws an

Access Denied

when run from the code-behind of the application page.

    SPSecurity.RunWithElevatedPrivileges(delegate
    {
        using (SPSite site = new SPSite([Site GUID here])
        {              
            site.ReadOnly = true;
        }
    }

We have tried reflecting what SharePoint does on the application page in Central Admin, but it was not clear why it works there and not on our page (Some internal methods gets the parameter RequireCentralAdmin though, what ever that means)

Any clues?

Answer 1

RunWithElevatedPrivileges elevates to the AppPool account of the particular WebApp which might not have permissions to change the SPSite because it is not a Site Collection owner/admin.

From http://technet.microsoft.com/en-us/library/hh344224%28v=office.15%29.aspx

Using highly privileged accounts for application pools or services poses a security risk to the farm, and could allow malicious code to execute.

Instead of using RunWithElevatedPrivileges, I'd rather use SPUserToken like this:

SPSite site = new SPSite([Site GUID here], SPUserToken.SystemAccount)
{              
    site.ReadOnly = true;
}

This ensures that the code runs as SharePoint\System which IMHO should have the required permissions.

See also: http://extreme-sharepoint.com/2012/05/30/impersonation-elevation-of-privileges

Using SPUserToken also has the additional benefit of being faster because it doesn't change the Windows Security Context like RunWithElevatedPrivileges does.