1

I have a workflow (developed in Visual Studio) that is started on creation of an item in List A. Most users have permission to create items in this list.

The workflow subsequently updates another list, List B, that most users do NOT have permission to Add/Edit items in (but do have permission to View items).

The workflow seemed to be working fine as I was developing and testing. But now I've noticed that the workflow goes into Suspended state with users that do not have Edit permissions to List B. As soon as I grant users Edit permissions to List B the workflow works.

Q: Do SharePoint 2013 workflows run as the current user by default? If so, how can I have them run with higher privileges to resolve this issue?

Edit: The message I get before it goes into Suspended state is this:

Retrying last request. Next attempt scheduled in less than one minute. Details of last request: HTTP Unauthorized to [site]/_vti_bin/client.svc/web/lists/getbyid(guid'5427d1e2-d15c-47db-aa39-8c77a1a1b879')/Items(2)

2

In Sharepoint 2013 one thing called App Step and that it is a mechanism provided to developers of SharePoint 2013-platform workflows (Designer workflows or Visual Studio workflows) to elevate permission of the workflow. you have to do following steps.

  • Allow workflow to use app permissions.
  • Grant full control permission to workflow.
  • Develop the workflow to wrap actions inside an App Step.

Create a workflow with elevated permissions by using the SharePoint 2013 Workflow platform

A word about App Step in SharePoint 2013 Workflow Platform

http://summit7systems.com/app-step-or-impersonation-step-in-sharepoint-designer-2013/

  • Does this still apply to a Server solution? My workflow is part of a Server solution developed with Visual Studio. – Submits Apr 24 '15 at 18:33
  • it applied to visual studio workflows as well. – Waqas Sarwar MVP Apr 24 '15 at 18:35
  • Will I need to do this for any 2013 framework workflow I develop that updates a list that the current user does not have permissions to update? – Submits Apr 24 '15 at 18:49
  • that's correct. – Waqas Sarwar MVP Apr 24 '15 at 18:49
  • Thanks. Now working after following the three steps you outlined. – Submits Apr 27 '15 at 9:58
2

Sharepoint workflows have always run under the context of the user who initiated the workflow process. There were ways to run as the system account in 2007 but that was removed. In 2010 there are impersonation steps that allow actins to run under the context of the person who publishes the workflow. I believe the impersonation steps exist in 2013 as well.

  • Having a read of the article below suggests otherwise (although it's in reference to SP2010), unless I am reading it wrong? technet.microsoft.com/en-us/library/… – Submits Apr 24 '15 at 18:30
  • Specifically: "The most important security concept to be aware of is that workflows run as part of the system account in SharePoint Server 2010, through the identity application pool settings on the server computer and domain. This means that within SharePoint Server 2010, workflows have administrator permissions. On the server, workflows have the same permissions as the application pool, which frequently has administrator permissions... – Submits Apr 24 '15 at 18:31
  • ... These permissions enable workflows to perform actions that ordinary users cannot perform, such as routing a document to a specific location or records center, or adding a user account to the system." – Submits Apr 24 '15 at 18:31
  • Running as an administrator is not the default behavior. "In SharePoint Server 2010, declarative workflows always run in the user context of the workflow initiator unless an impersonation step is encountered." – Eric Alexander Apr 24 '15 at 18:34
  • Right, so I guess the next question is, how do I add an impersonation step in my workflow? It's a 2013 Visual Studio workflow and I can't seem to find an impersonation or elevated privileges activity. I understand such an activity IS available in SharePoint Designer. – Submits Apr 24 '15 at 18:40
0

You can use "AppOnlySequence" from the workflow toolbar to run any workflow activity with elevated permissions. Note: In Visual studio this option is under SP-Utilities header on workflow toolbar.

0

Regarding your error message,

Retrying last request. Next attempt scheduled in less than one minute. Details of last request: HTTP Unauthorized to [site]/_vti_bin/client.svc/web/lists/getbyid(guid'5427d1e2-d15c-47db-aa39-8c77a1a1b879')/Items(2)

It looks a permission issue and you need to elevate workflow permissions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.