FeatureActivated event receiver giving access denied when trying so set WebApplication property

Question

When a Site event feature is activated I am trying to set some properties on the web application. My feature uses this value.

 public override void FeatureActivated(SPFeatureReceiverProperties properties)
        {
            SPSecurity.RunWithElevatedPrivileges(delegate()
            {
                SPSite site = properties.Feature.Parent as SPSite;
                if (site != null)
                {
                    SPWebApplication web = site.WebApplication;
                    web.Properties["test"] = "test";
                    web.Update();
                }
            });
        }

This however is giving me the following errors in Event Viewer.

Log Name: Application Source: Microsoft-SharePoint Products-Web Content Management Date: 08/02/2012 11:06:53 Event ID: 7363 Task Category: Publishing Cache Level:
Critical Keywords: User: USER NAME Computer:
SERVER NAME Description: Object Cache: The super reader account utilized by the cache does not have sufficient permissions to SharePoint databases. To configure the account use the following command 'stsadm -o setproperty -propertyname portalsuperreaderaccount -propertyvalue account -url webappurl'. It should be configured to be an account that has Read access to the SharePoint databases. Additional Data: Current default super reader account: NT AUTHORITY\LOCAL SERVICE

followed by

Log Name: Application Source: Microsoft-SharePoint Products-SharePoint Foundation Date: 08/02/2012 11:07:08 Event ID: 6615 Task Category: Runtime Level: Error Keywords: User: NT AUTHORITY\IUSR Computer:
COMOUTER Description: Access denied.

Why am I getting an Access denied when I am running with RunWithElevatedPrivileges?

Update

From @SPArchaeologist feedback but not taking hi sadvice I have tried to turn off RemoteAdministratorAccessDenied. I have also removed RunWithElevatedPrivileges as we don't think it is needed.

    public override void FeatureActivated(SPFeatureReceiverProperties properties)
    {
        var remoteAdministratorAccessDenied = SPWebService.ContentService.RemoteAdministratorAccessDenied;
        if (SPWebService.ContentService.RemoteAdministratorAccessDenied == true)
        {
            SPWebService.ContentService.RemoteAdministratorAccessDenied = false;
            SPWebService.ContentService.Update(true);
        }


        SPSite site = properties.Feature.Parent as SPSite;
        if (site != null)
        {
            SPWebApplication web = site.WebApplication;
            web.Properties["test"] = "test";
            web.Update();
        }

        SPWebService.ContentService.RemoteAdministratorAccessDenied = remoteAdministratorAccessDenied;
        SPWebService.ContentService.Update(true);
    }

Still getting the same errors as before.

The scope of my feature is Site.

Update

web.update() & SPWebService.ContentService.Update(true); are giving the access denied.

Answer 1

From your code it would seem that you are trying to set a web-application property from a site collection scoped feature.

If you are using SharePoint 2010, I can assume that you are experiencing the effect of the new "RemoteAdministratorAccessDenied" security setting, which among the others by default block any attempt to alter a web app property from a site collection / web site scope (Taken from Ms knowledgbase: "This feature explicitly blocks any modifications to the objects inheriting from SPPersistedObject in the Microsoft.SharePoint.Administration namespace and does not allow the content web applications to update the configuration database"). If this is your case you have two possibile solution:

• Rescope your features so that web application related activity are performed by a web application scoped feature

• Disable the security setting (I won't suggest this, the security setting was created with a purpose in mind), either via power shell or a console app. Notice that you cannot use a site scoped feature - this would just throw another Access Denied error.

  function Set-RemoteAdministratorAccessDenied-False() { [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint") > $null [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Administration") > $null # get content web service $contentService = [Microsoft.SharePoint.Administration.SPWebService]::ContentService # turn off remote administration security $contentService.RemoteAdministratorAccessDenied = $false $contentService.Update()
} Set-RemoteAdministratorAccessDenied-False

If you are using SharePoint 2007, remember that by using SPSecurity.RunWithElevatedPrivileges you will just impersonate the app pool account (which may or may not have sufficient right to update the web app settings). Anyway, your actual code is not using the RunWithElevatedPrivileges construct correctly. You need to recreate the SPSite / SPWeb instance inside the delegate, or the impersonation won't work.

---

Note: currently fighting to format the powershell snippet above. If anyone want to edit, fell free to fix the formatting and remove this notice.

Answer 2

It appears from the code that your application pool account is trying write into the SharePoint Configuration Database. However, it is not the best practice to grant application pool account to run as a Farm administrator and make changes to the Configuration database.

Answer 3

I have had the same issue. My problem is that I NEED to create a new timer job every time for an ItemUpdating event. Seems to be impossible to create a new timer job from this scope. Is not working even I'm using SPSecurity.RunWithElevatedPrivileges and AppPool is same as central admin AppPool.

In the end, I managed to solve my problem by using the wonderful class: SPWorkItemJobDefinition