1

Requirement :

Web Application "A" - App-pool account : acc1 - Classic Mode Authentication

Web Application "B" - App-pool account : acc2 - Classic Mode Authentication

Web Application "C" - App-pool account : acc3 - Claims Mode Authentication + Kerberos

Create site collection in web application B from web application A programmatically (on click of a link). For creating site collection I am using selfservicecreatesite (with quota template parameter).

Permission : acc1 has full control on web app B and Web app C (through user web policy + explicit rights from database)

Exception : Site collection is getting created but exception thrown 'Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))'.

Can anyone help on it?

Improve this question
2
  • 1
    What ownerLogin are you passing in SelfServiceCreateSite? Is is the same user you're logged in when you click the site creation link?
    – Jussi Palo
    Commented Feb 21, 2012 at 7:04
  • no its not the same user that has logged in .....
    – Monica Jagani
    Commented Feb 21, 2012 at 9:50

3 Answers 3

Reset to default
1

There are 5 solutions:

  1. Grant your application pool accounts appropriate rights to the configuration database.
  2. Create a custom windows service that runs as the farm account and uses .NET remoting to communicate tasks.
  3. Create a virtual application under the _layouts folder of each web application and have it run using the SCA application pool.
  4. Direct all site collection requests to an application page under the SCA site and pass in target values.
  5. Call a web service running under the SCA's _layouts folder.

For more details look here.

Improve this answer
1
  • Above solution is not possible to implement in my current solution.
    – Monica Jagani
    Commented Feb 21, 2012 at 8:30
0

Enable "Use Self-Service Site Creation" permission in the Web Application B's "User Permissions".

I believe the reason for acc1 not being able to access web app C is that identities are different when the authentication method for web app is different. So when you use SPRunWithElevatedPrivileges on web app 1, you will impersonate as acc1, but that acc1 isn't the same acc1 on web app 3 as it is on web app 1 due to authentication methods being different.

Someone please correct if I'm wrong.

Improve this answer
5
  • "Use Self-Service Site Creation" permission is enabled.
    – Monica Jagani
    Commented Feb 21, 2012 at 8:11
  • if the code is running from web app A and uses RunWithElevatedPrivileges (ie now code running under acc1) .can it access the resources of Web App C (i am getting access denied on it)
    – Monica Jagani
    Commented Feb 21, 2012 at 9:52
  • i am agreeing with you on your comment. How can we over come the issue ?
    – Monica Jagani
    Commented Feb 21, 2012 at 10:54
  • any help would be appreciated....
    – Monica Jagani
    Commented Feb 22, 2012 at 9:59
  • Can't really think of any feasible solution if custom web service or application under _layouts is not possible. Maybe open support case at MS, as I have a feeling there is some trick for this :/
    – Jussi Palo
    Commented Feb 23, 2012 at 6:52
0

Well a work around for this ...apply permission on web application c via powershell and not UI. When rights are assigned using powershell , junk character does not get attached to the user name.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.