2

I have a workflow (developed in Visual Studio) that is started on creation of an item in List A. Most users have permission to create items in this list.

The workflow subsequently updates another list, List B, that most users do NOT have permission to Add/Edit items in (but do have permission to View items).

The workflow seemed to be working fine as I was developing and testing. But now I've noticed that the workflow goes into Suspended state with users that do not have Edit permissions to List B. As soon as I grant users Edit permissions to List B the workflow works.

Q: Do SharePoint 2013 workflows run as the current user by default? If so, how can I have them run with higher privileges to resolve this issue?

Edit: The message I get before it goes into Suspended state is this:

Retrying last request. Next attempt scheduled in less than one minute. Details of last request: HTTP Unauthorized to [site]/_vti_bin/client.svc/web/lists/getbyid(guid'5427d1e2-d15c-47db-aa39-8c77a1a1b879')/Items(2)

Improve this question

4 Answers 4

Reset to default
2

In Sharepoint 2013 one thing called App Step and that it is a mechanism provided to developers of SharePoint 2013-platform workflows (Designer workflows or Visual Studio workflows) to elevate permission of the workflow. you have to do following steps.

  • Allow workflow to use app permissions.
  • Grant full control permission to workflow.
  • Develop the workflow to wrap actions inside an App Step.

Create a workflow with elevated permissions by using the SharePoint 2013 Workflow platform

A word about App Step in SharePoint 2013 Workflow Platform

http://summit7systems.com/app-step-or-impersonation-step-in-sharepoint-designer-2013/

Improve this answer
6
  • Does this still apply to a Server solution? My workflow is part of a Server solution developed with Visual Studio.
    – Submits
    Apr 24, 2015 at 18:33
  • it applied to visual studio workflows as well.
    – Waqas Sarwar MVP ♦
    Apr 24, 2015 at 18:35
  • Will I need to do this for any 2013 framework workflow I develop that updates a list that the current user does not have permissions to update?
    – Submits
    Apr 24, 2015 at 18:49
  • that's correct.
    – Waqas Sarwar MVP ♦
    Apr 24, 2015 at 18:49
  • Thanks. Now working after following the three steps you outlined.
    – Submits
    Apr 27, 2015 at 9:58
2

Sharepoint workflows have always run under the context of the user who initiated the workflow process. There were ways to run as the system account in 2007 but that was removed. In 2010 there are impersonation steps that allow actins to run under the context of the person who publishes the workflow. I believe the impersonation steps exist in 2013 as well.

Improve this answer
5
  • Having a read of the article below suggests otherwise (although it's in reference to SP2010), unless I am reading it wrong? technet.microsoft.com/en-us/library/…
    – Submits
    Apr 24, 2015 at 18:30
  • Specifically: "The most important security concept to be aware of is that workflows run as part of the system account in SharePoint Server 2010, through the identity application pool settings on the server computer and domain. This means that within SharePoint Server 2010, workflows have administrator permissions. On the server, workflows have the same permissions as the application pool, which frequently has administrator permissions...
    – Submits
    Apr 24, 2015 at 18:31
  • ... These permissions enable workflows to perform actions that ordinary users cannot perform, such as routing a document to a specific location or records center, or adding a user account to the system."
    – Submits
    Apr 24, 2015 at 18:31
  • Running as an administrator is not the default behavior. "In SharePoint Server 2010, declarative workflows always run in the user context of the workflow initiator unless an impersonation step is encountered."
    – Eric Alexander
    Apr 24, 2015 at 18:34
  • Right, so I guess the next question is, how do I add an impersonation step in my workflow? It's a 2013 Visual Studio workflow and I can't seem to find an impersonation or elevated privileges activity. I understand such an activity IS available in SharePoint Designer.
    – Submits
    Apr 24, 2015 at 18:40
0

You can use "AppOnlySequence" from the workflow toolbar to run any workflow activity with elevated permissions. Note: In Visual studio this option is under SP-Utilities header on workflow toolbar.

Improve this answer
0

Regarding your error message,

Retrying the last request. The next attempt scheduled in less than one minute. Details of last request: HTTP Unauthorized to [site]/_vti_bin/client.svc/web/lists/getbyid(guid'5427d1e2-d15c-47db-aa39-8c77a1a1b879')/Items(2)

It looks like a permission issue and to solve this issue, you have to check the following:

  1. Elevate workflow permissions
  2. Grant App Permissions SharePoint 2016
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.