10

Could you help me understand the SharePoint timer job?

The issue is simple. I should implement a page and put it to the layout folder (the page should be accessible from any web). This page should contain a button that adds a new job to the job definitions on the web application. Is it pretty simple? I don't think so...

When I tries to invoke job.Update() methods under my account or run this method under SPSecurity.RunWithElevatedPrivileges delegate I have got an Access Denied exception.

I found this post. Sean McDonough said

When a timer job instance is created, it is persisted to the farm configuration database. Accessing this database for write purposes is a privileged operation; as a rule of thumb, only the farm service account (that is, the account under which OWSTIMER.EXE executes) or accounts that explicitly have the rights required to carry out such an operation on the config database (typically administrators) will succeed.

I opened services and looked at the account under which OWSTIMER.EXE executes. It is a Network Services. I should be happy because my application pool uses the same account and I can use SPSecurity.RunWithElevatedPrivileges. But I'm not. I still have an access denied exception.

Next... I look at my account. My accout is a member of Farm administrator group. I can manage timer jobs on the configuration page in CA. I can do everything with any job. But it is only in CA. If I try to invoke job.Update() method on any other web I have access denied exception.

Sean also said

Timer job instances are typically created at Feature activation time in Features scoped at either the Farm or WebApplication level. Why? Because those Features are normally activated by administrators from either the command line (assuming the admin also has rights in the farm config database) or from within Central Administration.

I know that this solution works. I think that if I inherite my page from GlobalAdminPageBase and use it thru CA it will work too...

But is it possible to configure SharePoint to run timer job from page that is accessible from any web?

Why does not SPSecurity.RunWithElevatedPrivileges work in my case? Why don't I run job under my credentials?

Improve this question
2
  • Small clarification. Are you wanting to define and scope your job at the Web (Sub-Site) level or do you just want to put in a mechanism to initiate a job? As you describe the ApplicationPage with a button, it sounds like you just want to set it to run from there. That is a different question.
    – Mike Oryszak
    Nov 4, 2011 at 13:41
  • yes, I just want to put a mechanism to initiate a job to the application page.
    – Alexander
    Nov 4, 2011 at 13:43

4 Answers 4

Reset to default
8

Your issue is related to access to Configuration Database. Please follow the link for details - http://blog.falchionconsulting.com/index.php/2009/07/custom-sharepoint-2007-site-collection-creation-page/. It describes the same issues with creation of site collection and possible solutions and also touches Timer Job.

Improve this answer
3

I recommend you to read this and this blog posts. I am not sure about SP 2007, but in SP 2010 there is a property RemoteAdministratorAccessDenied (msdn page is not full of information, it's a pity). If this property setup to true, you can only update service from Central Admin pages, and if account, under code running has appropriate permissions.

As blog post mentioned, you must setup SPWebService.ContentService.RemoteAdministratorAccessDenied = false; but there are some pitfalls. You can setup value for ContentService only using PowerShell, or in feature receiver (web application or farm scoped -

Why? Because those Features are normally activated by administrators from either the command line (assuming the admin also has rights in the farm config database) or from within Central Administration

). Recently I try to implement very similar logic - I have a timer job, and users must have ability to setup job settings using site-scoped application page. On my local machine all worked fine (because I set RemoteAdministratorAccessDenied to true in past), but when we start test it users got access denied exception on line job.Update()

After investigations I found this blog post and decided to do the trick: just before job.Update() code I was trying set RemoteAdministratorAccessDenied to false, and then restore previous value, but I got access denied exception on line SPWebService.ContentService.RemoteAdministratorAccessDenied = false; I can't setup this property in site application page code behind. As I wrote above, only places where you can update this property - powershell or feature receiver(web app or farm scoped). How I solved my problem - I had to move this page to Central Admin, and now it works fine...

In your situation I suppose you can set RemoteAdministratorAccessDenied to false, but you must to know, if administrator using powershell set it to true, you page may suddenly stop working with access denied exception. Or another solution - move you page in CA.
I hope this helps.

Improve this answer
1
  • All solutions tell me that I have to move my page in CA... so I will do it, but I will investigate this question as soon as I will have a free time. Thanks, your answer is helpful.
    – Alexander
    Nov 5, 2011 at 18:56
1

Just remove SPSecurity.RunWithElevatedPrivileges and check in your code if the current user running your page has farm level permissions.

Using SPSecurity.RunWithElevatedPrivileges will switch to the application pool account which apparently is not a farm admin in your environment (which is a good thing for security measures).

Improve this answer
3
  • I do not use 'SPSecurity.RunWithElevatedPrivileges' when I try to create job under my account. As I said my account is a member of farm admin group.
    – Alexander
    Nov 5, 2011 at 6:25
  • Hi Sig, the applciation pool account is the account name which we give while creating the site collection administrator or is it the apppool name when creating web application?
    – variable
    Apr 25, 2014 at 6:53
  • The latter, the AppPool name used when creating a SharePoint Web Application.
    – Sig Weber
    Apr 25, 2014 at 13:35
0

Timer job won't running with SharePoint context which won't help elevated privileges. SPTimer and Central has to run under a AD account. Mostly access denied issues are coming on a standalone installation which most of the services are running under Network Service

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.