Access denied when adding a user to a group RunWithElevatedPrivileges

Question

I am trying to create a site and add users to its group. it creates the site successfully but when I try to add users to groups I get Access denied and no user has been added to groups here is my code:

 SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            using (SPSite site = new SPSite(newWebUrl))
            {
                using (SPWeb web = site.OpenWeb())
                {
                    foreach (string gName in pPickers.Keys)
                    {
                        web.EnsureUser(web.CurrentUser.LoginName);
                        PeopleEditor peopleEditor = pPickers[gName];

                        foreach (PickerEntity entity in peopleEditor.ResolvedEntities)
                        {
                            string groupName = gName + " on " + web.Title;

                            SPGroup group = web.Groups[groupName];
                            SPUser user = web.EnsureUser(entity.Key);

                            if (user != null)
                            {
                                group.AddUser(user);
                                group.Update();
                            }
                        }
                    }
                }
            }
        });

Answer 1

You are most likely receiving this error because the group membership can only be modified by the group owner. If you open the Group settings page - you will see a setting that governs who can edit the group membership. There are two options; Group owner and Group members. In the object model it is governed by the Boolean property SPGroup.AllowMembersEditMembership

Running with elevated privileges means that you are trying to modify the group membership in the context of the application pool account.

The solution is to take the SPUserToken of the group owner and create an impersonated context passing the user token into the overloaded SPSite constructor.

Answer 2

Try the following code. It is always better to use the token of the system account instead of running all your code inside of SPSecurity.RunWithElevatedPriviledges(). The code is much stable and secure this way.

UPDATE: Since you are using your code in an Application Page, make sure you have called the SPUtility.ValidateFormDigest() method before any of your elevated code. If that does not work, try setting the web.AllowUnsafeUpdates = true of the newly created web.

SPUtility.ValidateFormDigest();

SPUserToken sysToken = SPContext.Current.Site.SystemAccount.UserToken;
using (SPSite site = new SPSite(newWebUrl,sysToken))
{
    using (SPWeb web = site.OpenWeb())
    {
        foreach (string gName in pPickers.Keys)
        {
            web.EnsureUser(web.CurrentUser.LoginName);
            PeopleEditor peopleEditor = pPickers[gName];

            foreach (PickerEntity entity in peopleEditor.ResolvedEntities)
            {
                string groupName = gName + " on " + web.Title;

                SPGroup group = web.Groups[groupName];
                SPUser user = web.EnsureUser(entity.Key);

                if (user != null)
                {
                    group.AddUser(user);
                    group.Update();
                }
            }
        }
    }
}

Answer 3

can you try this:

using (SPWeb web = site.OpenWeb(SPContext.Current.Web.ID)) 

instead of:

using (SPWeb web = site.OpenWeb()) 

this will explain why your code is failing :)

http://blogs.msdn.com/b/sasohail/archive/2010/10/31/access-denied-within-spsecurity-runwithelevatedprivileges.aspx

another method is to use this:

http://sarangasl.blogspot.co.uk/2009/12/add-user-to-sharepoint-user-group.html

hope it helps :)