1

I run some SP-Code within the System Acoount. But even with that user I still receive an access denied acceptioon. I also tried other user accounts (with admin rights)

Error message:

Attempted to perform an unauthorized operation.   
 at Microsoft.SharePoint.SPGlobal.HandleUnauthorizedAccessException(UnauthorizedAccessException ex)    
 at Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask)    
 at Microsoft.SharePoint.SPRoleAssignmentCollection.Init()    
 at Microsoft.SharePoint.SPBaseCollection.GetEnumerator()    
 at OLXPermissionEventReceiver.OLXPermissionEventReceiver.OLXPermissionEventReceiver.<>c__DisplayClass1.<SetPermissionsToListItem>b__0()

Code:

        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            try
            {


                SPSite tmpSite = new SPSite("Http://example.com);

                SPUserToken sysUser = tmpSite.SystemAccount.UserToken;

                using (SPSite site = new SPSite(siteUrl, sysUser))
                {
                    using (SPWeb web = site.OpenWeb())
                    {
                        try
                        {
                            SPPrincipal principal = (SPPrincipal) group;                                                             
                            item.BreakRoleInheritance(false);                             
                            web.AllowUnsafeUpdates = true; 
                            // Works until here
                            List<SPRoleAssignment> roleAssignmentList = new List<SPRoleAssignment>();
                            bool cateringRoleFound = false;
                            foreach (SPRoleAssignment roleAssignment in item.RoleAssignments)
                            {

                            }

                        }
                    }
                }
            }
        }

It looks like the "foreach" - loop is throwing the error. Any idea?

1 Answer 1

3

I spotted two issues here:

Your running under elevated privlages (application pool account) and then your getting a new spsite object under system account using its token??? before all of that your getting the first spsite object but not disposing of that object awell! it could be that the application pool doesnt have the correct permissions todo what your asking it todo!

i bet if you debug you would find that SystemAccount.UserToken has access denied over it as your performing impersonation over elevated rights.... iv already answered how to do this correctly here and why:

SharePoint -access to path is denied

so for you its easy:

/// <summary>
/// get the system token from the list of users to elevate spsite
/// </summary>
/// <param name="spSite"></param>
/// <returns></returns>
protected static SPUserToken GetSystemToken(SPSite spSite) 
{     
    SPUserToken res = null;     
    bool oldCatchAccessDeniedException = spSite.CatchAccessDeniedException;
    try
    {
        spSite.CatchAccessDeniedException = false;
        res = spSite.SystemAccount.UserToken;
    }
    catch (UnauthorizedAccessException)
    {
        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            using (SPSite elevatedSPSite = new SPSite(spSite.ID))
                res = elevatedSPSite.SystemAccount.UserToken;
            // (***)         
        });
    }
    finally    
    {         
        spSite.CatchAccessDeniedException = oldCatchAccessDeniedException;     
    }     
    return res; 
}

now as you were doing you can now do this instead:

        SPUserToken sysToken = null;
        //let sharepoint dispose of the first spsite object to get token, you can change to any url or keep it the same if its the current site your trying to get
        using (SPSite spSite = new SPSite(SPContext.Current.Site.ID))
        {
            //get the system token from the method GetSystemToken and passing the spSite that you want to run under
            sysToken = GetSystemToken(spSite);

            //now wer have the token from the method above we can call as you did creating a new spsite object that is impersonated
            using (SPSite impersonatedSite = new SPSite(siteUrl, sysToken))
            {
                //we are impersonating the [@"SHAREPOINT\SYSTEM"] account
                //wrap around using as were using .openWeb which makes a new spweb object under the impersonated user account
                using (SPWeb web = impersonatedSite.OpenWeb())
                {
                    try
                    {
                        SPPrincipal principal = (SPPrincipal) group;                                                             
                        item.BreakRoleInheritance(false);                             
                        web.AllowUnsafeUpdates = true; 
                        // Works until here
                        List<SPRoleAssignment> roleAssignmentList = new List<SPRoleAssignment>();
                        bool cateringRoleFound = false;
                        foreach (SPRoleAssignment roleAssignment in item.RoleAssignments)
                        {

                        }

                    }
                }
            }
        }

that should solve your issue, its for 2010 but should apply to 2013.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.