0

Trying to migrate a legacy .net site from a SharePoint 2010 farm to SharePoint 2016. Simple IIS site that has one page for testing.

Run the site in IIS Express and everything works. Run the same site in IIS and I receive an Access Denied error.

  SPSecurity.RunWithElevatedPrivileges(Function() doSP(hURL))

  Function doSP(hURL As String)
                    Using hSite As New SPSite(hURL)
                        Using hWeb As SPWeb = hSite.OpenWeb()
                            Dim listItems As SPListItemCollection = hWeb.Lists("testx").Items
                            Dim item As SPListItem = listItems.Add()
                            item("Title") = "test1"
                            item.Update()
                        End Using
                    End Using
  End Function

App pool is running as my account and I also tried using the farm account. My account is granted Full Control to the SharePoint web app via User Policy. Also granted my account Site Collection Admin permissions.

Full error:
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

  • To be clear, this is an IIS web site running outside SharePoint on the WFE?I don't think I would use RunWithElevatedPrivileges in that context. What security context does your IIS app normally run under? – Derek Gusoff Feb 6 '18 at 20:14
  • No, the site runs on one of my SP WFE boxes. App pool runs under a service account with explicit permissions to one web app. ... I was asked to get it running, then we are moving the site to a dedicated app server outside the SP farm. – Taco_Buffet Feb 7 '18 at 0:16
  • This code will not run outside the farm. – Derek Gusoff Feb 7 '18 at 2:05
  • Yep, plan on modernizing the site to use web services calls and move away from using the server object model. – Taco_Buffet Feb 7 '18 at 12:57
0

try using AllowUnsafeUpdates = true; before the update and AllowUnsafeUpdates = false; after the update.

also like to note its very clear on IIS 8 the pitfalls of running code express (admin level) vs IIS (restricted permission)

Security Context for IIS Express


An important difference between the development servers in Visual Studio and IIS is the security context in which the servers run your ASP.NET pages. This difference can be a source of problems when you deploy a web site or web application to run on IIS.

When you run a page using IIS Express, the page runs in the context of your current user account. For example, if you are running as an administrator-level user, a page running in IIS Express will have administrator-level privileges. In contrast, in IIS 7 and IIS 8, ASP.NET runs as an account that has limited privileges by default. For more information, see Application Pool Identities on the IIS.net web site.

If you are simply reading and running the code in ASP.NET pages, this difference is not very important. However, the different security contexts for the two web servers can affect your testing in several ways:

https://msdn.microsoft.com/en-us/library/58wxa9w5(v=vs.120).aspx

if the above code doesn't work then look at impersonation rather than elevation.

  • Thank you for the info, ali. I failed to include AllowUnsafeUpdates is in my code example, but I am using it. Currently looking at rewriting the site using CSOM. – Taco_Buffet Feb 7 '18 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.