Approval Workflow - Moving document to a read only document library

Question

I have a document library (doclib1) with an approval workflow attached to it. On approval of a document I need to move the document to a separate document library (doclib2) which is read only and then delete the document from the original document library.

Before making doclib2 read only I added the following 2 additional actions to the workflow in SPD:

• When the document is approved:
  • Copy the file to the doclib2 document library
  • Delete the document from the doclib1 document library

This worked fine, but then I changed the library permissions on doclib2 the workflow fails with a Access Denied error.

I "Stopped Inheriting Permissions" removed the other permissions and granted:

• "SHAREPOINT\system" account Full Control permissions
• "Authenticated Users" Read Only permissions

But this doesn't seem to work. Can someone please help point me in the right direction to get this working?

Thanks.

Answer 1

Nice and simple explanation why are you receiving this error can be found here:

Declarative Workflows and User Context

The basic thing to remember is that declarative workflows (the one’s created by SharePoint Designer) always run impersonating the user who started the workflow

If you are using 2010 then you are lucky because:

Workflow Improvements in SharePoint Designer 2010

SharePoint Designer 2010 gives you the ability to create impersonation steps, which run in the security context of the workflow author. So it’s simple to create an entire process that will run in the context of the item submitter, but have one step which runs with elevated permissions. In that way we could setup an HR workflow that checks how many vacation days you have left and updates the number, without having to give the actual user anything more than read rights to the HR list. You only need to make sure the workflow author has the elevated permissions required on the list.

If you are using 2007 then possible solution is using SPDActivities project at CodePlex and Copy List Item Extended Activity. However I never use it myself and I am not sure it will work. There is also nice little disclaimer at bottom of the page.

Note: You don't need to add FullControl permission to SHAREPOINT\system account since this account already has all permissions.