Getting "Access denied" error message when trying to access a SharePoint list via Linq from an Web Service

Question

I have following scenario.

A web service hosted on IIS 7 should take messages from a MSMQ, transform them and put them into a custom SharePoint list.

The list, contenttype and columns were defined in an custom solution and were deployed to a website. From there I used SPMetal to generate the Entity classes so the list can be accessed using Linq.

The application pool of the web service runs under a custom domain account. This account is local admin on the SharePoint server, has full access to the web application the list is located on, has db_owner permission on the configuration database and on the web application's content database. All these permission are necessary otherwise the application pool account of the web service cannot even access the site collection the list is located in.

Till here, everything works more or less fine, perhaps granting all these permissions is not optimal but it works.

But when I create a DataContext object from the code generated by SPMetal and try to access the list via the corresponding property of the DataContext object I get an UnauthorizedAccessException saying:

"Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

at Microsoft.SharePoint.Library.SPRequest.GetListsWithCallback(String bstrUrl, Guid foreignWebId, String bstrListInternalName, Int32 dwBaseType, Int32 dwBaseTypeAlt, Int32 dwServerTemplate, UInt32 dwGetListFlags, UInt32 dwListFilterFlags, Boolean bPrefetchMetaData, Boolean bSecurityTrimmed, Boolean bGetSecurityData, Boolean bPrefetchRelatedFields, ISP2DSafeArrayWriter p2DWriter, Int32& plRecycleBinCount)
   at Microsoft.SharePoint.SPListCollection.EnsureListsData(Guid webId, String strListName)
   at Microsoft.SharePoint.SPListCollection.GetListByName(String strListName, Boolean bThrowException)
   at Microsoft.SharePoint.Linq.Provider.SPServerDataConnection.GetSPList(String url, String listName)
   at Microsoft.SharePoint.Linq.Provider.SPServerDataConnection.GetList(String url, String listName)
   at Microsoft.SharePoint.Linq.DataContext.<>c__DisplayClass2`1.<GetList>b__1()
   at Microsoft.SharePoint.Linq.DataContext.GetList[T](String listName, Func`1 getUrl, Func`1 getList, Boolean checkUrl)
   at Microsoft.SharePoint.Linq.DataContext.GetList[T](String listName)
   at EventSyncListEntitiesDataContext.get_EventSynchronizationServiceEvents() in C:\Users\fbe\Documents\Visual Studio 2010\Projects\EventSync\EventSyncService\EventSyncListEntities.cs:line 32
   at EventSyncService.EventSynchorinzationService.<>c__DisplayClass3.<ProcessEvent>b__0() in C:\Users\fbe\Documents\Visual Studio 2010\Projects\EventSync\EventSyncService\EventSynchorinzationService.svc.cs:line 41

Code:

SPSecurity.RunWithElevatedPrivileges(delegate
{
    using (EntitiesDataContext con = new EntitiesDataContext(GetSPWebUrlFromListUrl(listUrl)))
    {
        Event newSpEvent = EventFactory.CreateEvent(eventObject);

        var eventList = con.EventSynchronizationServiceEvents; // <-- Exception

        // Search for events with the same event id on the event list. 
        var checkEvent = from spListEvent in eventList                                                                                                                
                         where spListEvent.EventID == newSpEvent.EventID
                         select spListEvent;
    }
});

At the moment I don't know what I can do as I even get this error when I run the code with my farm administrator account.

So do you have any hints what might be wrong here?

UPDATE

Also without when I try to access the list without using the classes generated by SPMetal I cannot access the list and get the same error.

Answer 1

There are a couple of things i can tthink off:

• If you have the build target of the Web service project set to anything but "Any CPU" you will get Access denied errors, (I know, weird right?).
• Why not host the service directly under sharePoint. The WCF factories SharePoint provides make it dead easy to make the service available with fullblown SPContext etc. Also, security (access to the service and access from the service to sharepoint) will be taken care of by SharePoint.

Answer 2

While still looking for a solution and testing different things I found out that the error disappears when running the code without elevated privileges, so removing

SPSecurity.RunWithElevatedPrivileges(delegate{ [code] })

did the job. The list is now accessible. But unfortunately all the extra permissions are still needed. As Colin suggested I will move the whole code to a SharePoint Service Application soon so the permission problem should be history then.

Answer 3

I solve this issue by giving proper user credential in impersonate tag in webconfig.