FBA User Profile Creation Access Denied

Question

I'm writing this post because I think I've exhausted every other avenue. Basically I have a Claims-based SharePoint site that has Forms Authentication setup. Everything works well, registrations, etc.

I have also setup a MySite Host with self site creation turned on, so when a user who has just registered clicks on my profile, it either displays their profile or creates one there and then.

However, in our heavily customised site, we have a page that lists members, with links to their profiles. If a profile hasn't been created yet, the site errors, saying User not found.

My solution to this was to create a profile programatically at the user creation stage, but I simply can't get it to work. It always gives this error:

System.UnauthorizedAccessException: Access Denied: To create a user profile, you must be an administrator, or create your own profile and have personal features rights.

I've tried loads of tricks that people claim to get working, but it just won't for me. Eg. http://www.tcscblog.com/2012/06/20/access-denied-when-modifying-user-profiles/

I've also looked into user the User Profile Synch Service to synch the two but I can't that to work either.

The other reason I've wanted to do this is that my Reg form has some extra fields, say Job title, and Department that are in the profile system, and it would be good if I can create the profile there and then and prepopulate these fields with what has been entered at the registration stage.

I've tried using the user tokens, etc.

Guid siteCollectionId = SPContext.Current.Site.ID;
SPSecurity.RunWithElevatedPrivileges(delegate()
{
using (SPSite SPSite = new SPSite(SPContext.Current.Site.ID, SPContext.Current.Site.Zone, SPContext.Current.Site.SystemAccount.UserToken))
{
    using (SPWeb SPWeb = SPSite.OpenWeb(SPContext.Current.Web.ID))
    {
        SPUserCollection AllSPWebUsers = SPContext.Current.Web.AllUsers;
        SPGroupCollection AllSPWebGroups = SPContext.Current.Web.Groups;

        var context = SPServiceContext.GetContext(SPSite);
        UserProfileManager profileManager = new UserProfileManager(context);

        //Iterate through each group in the current site.
        foreach (SPGroup grp in AllSPWebGroups)
        {
            SPUserCollection UsersInGroup = grp.Users;

            foreach (SPUser user in UsersInGroup)
            {
                try
                {
                    SPSite.AllowUnsafeUpdates = true;
                    SPWeb.AllowUnsafeUpdates = true;
                    SPWeb.Update();

                    UserProfile profile = null;
                    if (!profileManager.UserExists(user.LoginName))
                    {
                        profile = profileManager.CreateUserProfile("i:0#.f|fbamembershipprovider|" + user.LoginName);
                    }
                    else
                    {
                        profile = profileManager.GetUserProfile(user.LoginName);
                    }

                    Literal1.Text += "<br /><br />Profile: <a href=\"" + profile.PersonalUrl + "\">" + profile.DisplayName + " " + user.LoginName + "</a>";
                    Literal1.Text += "<br />Email: <a href=\"mailto:" + user.Email + "\">" + profile.ProfileManager.IsClaimProvider + user.Email + "</a>";

                    SPSite.AllowUnsafeUpdates = false;
                    SPWeb.AllowUnsafeUpdates = false;
                    SPWeb.Update();
                }
                catch (Exception ex)
                {
                    //catch exception
                }
            }                  
        }
    }
}

});

I'm at a stage now where I don't know what to do at all. If anyone has any tips, code, answers, that would be awesome.

Thanks in advance, Bav

Answer 1

You have to determine what account context you are running under. RWEP is no guarantee that your code will work. I would try running as the user and (as the error indicates) ensure that the user has the Use Personal Features right (granted in Manage Service Applications).

If you REALLY want to pre-create the profiles, make sure you are using an account that has the Manage Profiles right. It is my guess that you have not properly granted permissions.

M

Answer 2

If you want to create the User Profiles prior to the user logging into the site, grab all of the users from the FBA data store and insert them into the UPA that is tied to that Web Application. I did this for AD LDS/ADAM at http://sharepoint.codeplex.com. For the specific code you might be interested in, see the Create method here.