I have following scenario.

A web service hosted on IIS 7 should take messages from a MSMQ, transform them and put them into a custom SharePoint list.

The list, contenttype and columns were defined in an custom solution and were deployed to a website. From there I used SPMetal to generate the Entity classes so the list can be accessed using Linq.

The application pool of the web service runs under a custom domain account. This account is local admin on the SharePoint server, has full access to the web application the list is located on, has db_owner permission on the configuration database and on the web application's content database. All these permission are necessary otherwise the application pool account of the web service cannot even access the site collection the list is located in.

Till here, everything works more or less fine, perhaps granting all these permissions is not optimal but it works.

But when I create a DataContext object from the code generated by SPMetal and try to access the list via the corresponding property of the DataContext object I get an UnauthorizedAccessException saying:

"Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

at Microsoft.SharePoint.Library.SPRequest.GetListsWithCallback(String bstrUrl, Guid foreignWebId, String bstrListInternalName, Int32 dwBaseType, Int32 dwBaseTypeAlt, Int32 dwServerTemplate, UInt32 dwGetListFlags, UInt32 dwListFilterFlags, Boolean bPrefetchMetaData, Boolean bSecurityTrimmed, Boolean bGetSecurityData, Boolean bPrefetchRelatedFields, ISP2DSafeArrayWriter p2DWriter, Int32& plRecycleBinCount)
   at Microsoft.SharePoint.SPListCollection.EnsureListsData(Guid webId, String strListName)
   at Microsoft.SharePoint.SPListCollection.GetListByName(String strListName, Boolean bThrowException)
   at Microsoft.SharePoint.Linq.Provider.SPServerDataConnection.GetSPList(String url, String listName)
   at Microsoft.SharePoint.Linq.Provider.SPServerDataConnection.GetList(String url, String listName)
   at Microsoft.SharePoint.Linq.DataContext.<>c__DisplayClass2`1.<GetList>b__1()
   at Microsoft.SharePoint.Linq.DataContext.GetList[T](String listName, Func`1 getUrl, Func`1 getList, Boolean checkUrl)
   at Microsoft.SharePoint.Linq.DataContext.GetList[T](String listName)
   at EventSyncListEntitiesDataContext.get_EventSynchronizationServiceEvents() in C:\Users\fbe\Documents\Visual Studio 2010\Projects\EventSync\EventSyncService\EventSyncListEntities.cs:line 32
   at EventSyncService.EventSynchorinzationService.<>c__DisplayClass3.<ProcessEvent>b__0() in C:\Users\fbe\Documents\Visual Studio 2010\Projects\EventSync\EventSyncService\EventSynchorinzationService.svc.cs:line 41


    using (EntitiesDataContext con = new EntitiesDataContext(GetSPWebUrlFromListUrl(listUrl)))
        Event newSpEvent = EventFactory.CreateEvent(eventObject);

        var eventList = con.EventSynchronizationServiceEvents; // <-- Exception

        // Search for events with the same event id on the event list. 
        var checkEvent = from spListEvent in eventList                                                                                                                
                         where spListEvent.EventID == newSpEvent.EventID
                         select spListEvent;

At the moment I don't know what I can do as I even get this error when I run the code with my farm administrator account.

So do you have any hints what might be wrong here?


Also without when I try to access the list without using the classes generated by SPMetal I cannot access the list and get the same error.

3 Answers 3


There are a couple of things i can tthink off:

  • If you have the build target of the Web service project set to anything but "Any CPU" you will get Access denied errors, (I know, weird right?).
  • Why not host the service directly under sharePoint. The WCF factories SharePoint provides make it dead easy to make the service available with fullblown SPContext etc. Also, security (access to the service and access from the service to sharepoint) will be taken care of by SharePoint.
  • Yes, I think we will adapt the code soon and make it a SharePoint Service Application. But we've started without it as we had to get the MSMQ part working first and so developing without all the SharePoint stuff was easier.
    – Flo
    Jun 8, 2011 at 13:05
  • 1
    It doesn;t have to be a service application, it can just be a service (WCF), see how to do that here: msdn.microsoft.com/en-us/library/ff521581.aspx. By editiing the .svc file and setting the Factory to MultipleBaseAddressBasicHttpBindingServiceHostFactory and the ndeploy it to the ISAPI folder it will work under a sharepoint context
    – Colin
    Jun 8, 2011 at 13:19
  • Ah ok, I didn't know this but we'll also some configuration dialogs and so on, so a service application would be nice I guess.
    – Flo
    Jun 8, 2011 at 13:24
  • Then yes, that would be handy. We store most config settings for services in the SPWebApplication's PropertytBag though, and provision a custom app page in the central admin to change these.
    – Colin
    Jun 8, 2011 at 16:16

While still looking for a solution and testing different things I found out that the error disappears when running the code without elevated privileges, so removing

SPSecurity.RunWithElevatedPrivileges(delegate{ [code] })

did the job. The list is now accessible. But unfortunately all the extra permissions are still needed. As Colin suggested I will move the whole code to a SharePoint Service Application soon so the permission problem should be history then.


I solve this issue by giving proper user credential in impersonate tag in webconfig.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.