AccessDenied from ValidateFormDigest when calling ModifyUserPropertyByAccountName in userprofileservice.asmx

Question

I'm using the ModifyUserPropertyByAccountName method of userprofileservice.asmx in SharePoint 2013 to modify the user profile properties of another user. I can read properties using the GetUserPropertyByAccountName method in the same web service, but the modify/update fails.

The web service call is made from a provider-hosted SharePoint App/Add-in running under a service account identity. The service account has been given Manage Profiles permission to the User Profile Service Application (in Administrators).

When calling ModifyUserPropertyByAccountName I can see in the ULS log that something I reach the web service method because something is processing, looks like validation of my taxonomy properties, but when the changes are to be really applied an error occur. See stack trace below.

What am I doing wrong? Any additional permissions that are required?

System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)), StackTrace:   
 at Microsoft.SharePoint.SPWeb.ValidateFormDigest()    
 at Microsoft.Office.Server.UserProfiles.UserProfile.UpdateBlobProfile(Boolean bBypassCanary)    
 at Microsoft.Office.Server.UserProfiles.UserProfile.Commit(Boolean allowUnsafeUpdates)    
 at Microsoft.Office.Server.UserProfiles.UserProfileService.ModifyUserPropertyByAccountName(String accountName, PropertyData[] newData)    
 at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)    
 at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)    
 at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)    
 at System.Web.Services.Protocols.LogicalMethodInfo.Invoke(Object target, Object[] values)    
 at System.Web.Services.Protocols.WebServiceHandler.Invoke()    
 at System.Web.Services.Protocols.WebServiceHandler.CoreProcessRequest()    
 at System.Web.Services.Protocols.SyncSessionlessHandler.ProcessRequest(HttpContext context)    
 at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()    
 at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)    
 at System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception error)    
 at System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb)    
 at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)    
 at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)    
 at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus& notificationStatus)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)    
 at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)

Answer 1

The reason for this error is that the service account doesn't have read permissions to the root site.

Assigning the Manage Profile permission only grants you permission to run the userprofileservice.asmx web service in general. As you have seen in your tests this is enough to be able to read properties using the web service but as you see in the stack trace the ModifyUserPropertyByAccountName method calls ValidateFormDigest which require that the account performing the call has read access to the site.

So if you are using http://intranet.xyz.lan/_vti_bin/userprofileservice.asmx in your call to the web service then assign the service account Read permission to http://intranet.xyz.lan (easiest is to just add the account to the Visitors group).

I cannot speculate as to why ValidateFormDigest is being called, but it does sound reasonable that the account need to have access to the site in order for that call to be succeessful.