I have a problem when trying to set SSS credentials for a target application using C#. Console application is used for this task.

I can successfully create a Target Application with fields, admins and members etc. However! At the very last moment (see the code blow), when I'm trying to write credentials for a given SSS Target Application I receive an "Access denied" when using SetUserCredentials or SetCredentials methods.

Method SetGroupCredentials runs with no errors but does nothing, credentials are not set.

So, I've got two questions:

  • What is a correct way to set Credentials for SSS?
  • Why do I get "Access Denied" error?

Additinal info:

  • I am a farm adiministrator
  • App pool account has full control on the entire Secure Store Service app

    private void btnUpdateCredentials_Click(object sender, EventArgs e) { SecureStoreServiceProxy ssp = new SecureStoreServiceProxy();

       SPServiceContext context =   SPServiceContext.GetContext(SPServiceApplicationProxyGroup.Default, SPSiteSubscriptionIdentifier.Default);
       ISecureStore iss = ssp.GetSecureStore(context);
        foreach (DataGridViewRow row in grid.SelectedRows)
            MappingRow mappingRow = row.DataBoundItem as MappingRow;
            TargetApplication targetApp = new TargetApplication(
            var userName = new TargetApplicationField(
                "User name",
            var password = new TargetApplicationField(
                "User password",
            var SSASRole = new TargetApplicationField(
                "SSAS Role",
            IList<TargetApplicationField> fields = new TargetApplicationField[] { userName, password, SSASRole };
            SPClaim adminBasicClaim = SPClaimProviderManager.CreateUserClaim(admin, SPOriginalIssuerType.Windows);
            SecureStoreServiceClaim adminClaim = new SecureStoreServiceClaim(adminBasicClaim);
            SPClaim groupBasicClaim = SPClaimProviderManager.CreateUserClaim(mappingRow.ReadLoginOrDomain, SPOriginalIssuerType.Windows);
            SecureStoreServiceClaim groupClaim = new SecureStoreServiceClaim(groupBasicClaim);
            TargetApplicationClaims claims = new TargetApplicationClaims(
                new List<SecureStoreServiceClaim>() { adminClaim },
                new List<SecureStoreServiceClaim>() { groupClaim },
                iss.CreateApplication(targetApp, fields, claims);
            catch (Exception ex)
               //TODO app already exists
            IList<ISecureStoreCredential> creds = new List<ISecureStoreCredential>(3);
            creds.Add(new SecureStoreCredential(SecurityString.MakeSecureString(mappingRow.ShadowAccount), SecureStoreCredentialType.WindowsUserName));
            creds.Add(new SecureStoreCredential(SecurityString.MakeSecureString(mappingRow.ShadowPassword), SecureStoreCredentialType.WindowsPassword));
            creds.Add(new SecureStoreCredential(SecurityString.MakeSecureString(mappingRow.SqlRole), SecureStoreCredentialType.Generic));
            SecureStoreCredentialCollection credsColection = new SecureStoreCredentialCollection(creds);
           //Exception: Access denied An unhandled exception of type 'Microsoft.Office.SecureStoreService.Server.SecureStoreServiceException' occurred in Microsoft.Office.SecureStoreService.dll
           //Access is denied to the Secure Store Service.
           iss.SetUserCredentials(mappingRow.SssId, groupClaim, credsColection);
           //Exception: Access is denied to the Secure Store Service.
           iss.SetCredentials(mappingRow.SssId, credsColection);
           //Code runs, but nothing happends:
           iss.SetGroupCredentials(mappingRow.SssId, credsColection);
  • Which account you are using? – Amal Hashim Jun 2 '15 at 14:51
  • I am using farm account which is also app pool account, local admin and SSS admin with full control. I also use another user account wich has the same level of rights everywhere – Denis Molodtsov Jun 2 '15 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.