Breaking my head with this issue for the past 2 days!

Received Access Denied error in SPD so tried to set Meta Data permission and get the following error.

enter image description here

  1. I am one of the Admins for BSC service Applications
  2. I belong to Farm Admin Group
  3. I have required permission in SQL
  4. Tried opening CA in Admin Mode (IE -> Run as Administrator)
  5. ULS Logs shows the following

    Access Denied for User '0#.w|domain\skumar', which may be an impersonation by 'DOMAIN\skumar'. Securable IMetadataCatalog with Name 'ApplicationRegistry' has ACL that contains:

Any more ideas? please let me know if you need more information.


Here is the stack trace

'BCS' BdcServiceApplication logging server side AccessDeniedException before marshalling and rethrowing on client side: Access Denied for User '0#.w|domain\skumar', which may be an impersonation by 'domain\skumar'. Securable IMetadataCatalog with Name 'ApplicationRegistry' denied access. Stack Trace: at Microsoft.SharePoint.BusinessData.SharedService.IndividuallySecurableMetadataObjectAccessor.SetAccessControlEntries(MetadataObjectStruct metadataObjectStruct, AccessControlEntryStruct[] aces, String settingId, DbSessionWrapper dbSessionWrapper) at Microsoft.SharePoint.BusinessData.SharedService.BdcServiceApplication.<>c__DisplayClass2c.b__2b() at Microsoft.SharePoint.BusinessData.SharedService.BdcServiceApplication.Execute[T](String operationName, UInt32 maxRunningTime, ExecuteDelegate`1 operation)

  • What's the value of AuthenticationMode element in the XML Metadata Model file that External Content Type? Commented Jun 14, 2011 at 16:26
  • Can you provide the full stack trace of the Access Denied exception so we can see what operation you were trying to perform.
    – Steve P
    Commented Jun 14, 2011 at 18:54
  • @Ashish .. I get Access Denied while creating the new ext content type and the suggested fix was to add meta data permissions. I am site collection admin too.
    – Shoban
    Commented Jun 15, 2011 at 5:08
  • @Steve P I have edited the question to include Stack Trace.
    – Shoban
    Commented Jun 15, 2011 at 5:09
  • In the Managed Metadata Database are you listed as one of the Principals in the ECMPermission Table?
    – MichaelF
    Commented Jun 16, 2011 at 19:37

2 Answers 2


Our solution was to go to SP Central Admin > System Settings > Services on Server and start the "Claims to Windows Token Service". We also found this error in the logs which helped lead us to this as the solution:

SPSecurityContext.WindowsIdentity: Could not retrieve a valid windows identity for NTName='PRMM-SP\polyadmin', UPN='[email protected]'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.EndpointNotFoundException: There was no endpoint listening at net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2 that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.IO.PipeException: The pipe endpoint 'net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2' could not be found on your local machine.

For us I feel that this situation may only occur because the user we are trying to add in the metadata permissions has both an AD and ADFS (claims) entry. I have seen where EnsureUser or some other API call fails when you have identical IDs across two user stores.

  • Thanks to @el_hombre who did the work behind the scenes and found the answer. Commented Jan 31, 2012 at 22:02
  • More than one week I was confused with this error... Thanks for your answer. Commented Mar 19, 2014 at 6:22

It sounds as though need to go into your Business Data Connectivity Service Application, and set the permissions on the object. First, go to Central Administration->Application Management->Manage service applications. Find your Business Data Connectivity service application and go to the Manage page. Select the external content type and go to Set Permissions on the ECB menu, or the Set Object Permissions on the ribbon. From the Set Object Permissions pop-up dialog page you can add accounts and set their permissions. You will need to give the user who is logging in to SharePoint at least Execute permission to be able to see the list items (not to be confused with the account that will access the database).

I have blogged a few error messages like this one that keep catching me out.

  • Read your anwer quickly and This is when I get the error :-) I dont have access to SharePoint site now. Will check and update you. Thanks
    – Shoban
    Commented Jul 13, 2011 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.