Why does a workflow cancel with "access denied" for all but users with Full Control accesse?

Question

I am working with an existing SharePoint deployment that has a convoluted security structure. After cleaning up permissions a bit, an approval workflow for absence requests is somehow not working for normal users. If a user with full control fills out a request, the workflow runs normally. However, if a user with Read & Add Only access generates one, the workflow fails with an "Access Denied" entry in the history.

I'm 99% sure that this is a permissions issue. All lists (workflow history and tasks included) have the same permissons now as indicated above. The System Account (the account the history entries are stamped with) has Limited Access permissons only but I wouldn't think that even a Full Control user would work if the problem was there. What other resources does workflow touch that might cause this?

Description: The workflow could not update the item, possibly because one or more columns for the item require a different type of information.

Answer 1

Run it with elevated privileges like this:

SPSecurity.RunWithElevatedPrivileges(delegate()
{
    using (SPSite site = new SPSite(baseUrl))
    {
        using (SPWeb web = site.OpenWeb())
        {
            SPList list = web.Lists["Documents"];
            Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager wsm = new Microsoft.SharePoint.WorkflowServices.WorkflowServicesManager(web);
            Microsoft.SharePoint.WorkflowServices.WorkflowInstanceService service = wsm.GetWorkflowInstanceService();

            //note:  There can be only 1 running workflow per item
            var instances = service.EnumerateInstancesForListItem(gPageList, pageID);
            foreach (var instance in instances)
            {
                if (instance.Id == gWorkflowInstanceId)
                {
                    service.CancelWorkflow(instance);
                    break;
                }
            }
        }                   
    }
});