2

Yes I know it is duplicate question of this and this, but I want to check if user belongs to active directory group with out RunWithElevatedPrivileges. Is it possible?

HttpContext.Current.User.IsInRole("domain\\groupname");

This always returns false. Even if I am in.

I have been googling this for very long.

Is using RunWithElevatedPrivileges affect anything in sharepoint farm level code? If possible please provide any link that refers it is not harmful to use RunWithElevatedPrivileges. Appreciate you help on this.

1 Answer 1

1

Elevation of privilege, a feature that was added in Windows SharePoint Services 3.0, enables you to programmatically perform actions in code by using an increased level of privilege. The SPSecurity.RunWithElevatedPrivileges method enables you to supply a delegate that runs a subset of code in the context of an account with higher privileges than the current user.

Although elevation of privilege provides a powerful technique for managing security, it should be used with care. You should not expose direct, uncontrolled mechanisms for people with low privileges to circumvent the permissions granted to them. Elevation of Privilege

If your code run under a farm admin(who is local admin as well) then you dont need this method, but issue is when user does not have the right permission then we need this. It runs using the App Pool account, so you must ensure that the App Pool account is a member of a site collection group with sufficient perms to to add/edit/delete or whatever your code is trying to do.

So their is always risk involve with it.Here are some points to follow while working with RunWithElevatedPrivileges.

  • Avoid using SPSecurity.RunWithElevatedPrivileges to access the SharePoint object model. Instead, use SPUserToken to impersonate SPSite with a specific account, as shown previously.

  • If you do use SPSecurity.RunWithElevatedPrivileges, dispose of all objects in the delegate. Do not pass SharePoint objects out of the RunWithElevatedPrivileges method.

  • Only use SPSecurity.RunWithElevatedPrivileges to make network calls under the application pool identity. Don’t use it for elevation of privilege of SharePoint objects.

http://www.enjoysharepoint.com/Articles/Details/runwithelevatedprivileges-in-sharepoint-2010-238.aspx

When and How to Use Run With Elevated Privileges (RWEP) in SharePoint

4
  • Excellent! Just to clarify - what about getting users active directory groups using SPSecurity.RunWithElevatedPrivilege? As you said "use it to make network calls under the application pool identity". There would not be any security harm in touch AD right?
    – Maddy
    Mar 27, 2015 at 21:05
  • I think it is safe as well if use in your code block and follow the tips mentioned above. why not you directly get the information from AD directly, as mentioned in one of the anwser? arunjameskc.wordpress.com/2010/08/04/…
    – Waqas Sarwar MVP
    Mar 27, 2015 at 21:10
  • Your link saved me and directed me to the correct path - 'SPGroup.ContainsCurrentUser' does the trick. Actually this is exact thing I am looking for - cosmicice.blogspot.com/2009/03/…
    – Maddy
    Mar 30, 2015 at 15:02
  • Glad to solve your problem
    – Waqas Sarwar MVP
    Mar 30, 2015 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.