3

I have a SPItemEventReceiver which does some stuff with an external list when a document is uploaded to a DocLib. I now wanted to have it also run when an e-mail is sent to that DocLib.
I could have used an SPEMailEventReceiver, but I stuck with my old event receiver as it is working up until a point:

When trying to access the external list I get the following error:

Access Denied for User '', which may be an impersonation by 'mydomain\myuser'. Securable MethodInstance with Name 'Read List' has ACL that contains:...

Now there are numerous posts that explain that I should set permissions for the BCS model in the central administration (or the model itself) and this is where my problem resides (as pretty much everyone has permissions).

As the event receiver is being run by owstimer.exe the user (owstimer is being run by the farm account) is somehow cut off or something like that (see the empty user string in the error message). I gave permissions to everyone on the BCS model. The farm account, the app pool account, anonymous access, all authenticated users, IUSR, network service - they all have execute permission - no luck. The BCS model is configured with windows authentication and Kerberos is active.

I am pretty sure that the problem stems from owstimer running the code. Maybe someone else experienced this issue and knows a way around this? Maybe there is some way I could tell my code to run as some user that I know has the permission?

Improve this question
3
  • Can you clarify, under which account the OWSTimer.exe process is running in your environment?
    – Andrey Markeev
    Commented Jan 31, 2012 at 11:57
  • The farm account (not best practice I know).
    – Dennis G
    Commented Jan 31, 2012 at 13:27
  • What does your setup look like? Single Server? Multi Server Farm? Where is incoming email running? Maybe it is an "delegation issue" where the ows timer tries to use kerberos constrained delegation to impersonalte the user? I remeber an issue related to workflow and incoming email. Check out this links: support.microsoft.com/default.aspx?scid=kb;EN-US;953289 support.microsoft.com/kb/947284/en-us
    – Marco Scheel
    Commented Feb 3, 2012 at 9:09

1 Answer 1

Reset to default
1

Based on my experiments in the case of an OWSTimer process you should access your external data using the BCS API instead of running a CAML query against the external list. See details here: http://pholpar.wordpress.com/2012/02/14/accessing-external-data-from-sharepoint-timer-jobs-or-from-event-receivers-triggered-by-incoming-mail/

Improve this answer
1
  • Crazy. The BCS API seems to be doing different stuff than standard CAML queries... good to know.
    – Dennis G
    Commented Feb 14, 2012 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.