2

I'm trying to let a SharePoint 2013 workflow run as a regular user (not a site collection administrator).

When starting the workflow it fails right away with the error:

RequestorId": c0c2fcc9-abfb-6e2b-f229-68417fb5815c. Details: System.ApplicationException: HTTP 401 {"Transfer-Encoding":["chunked"],"X-SharePointHealthScore":["0"],"SPRequestGuid":["c0c2fcc9-abfb-6e2b-f229-68417fb5815c"],"request-id":["c0c2fcc9-abfb-6e2b-f229-68417fb5815c"],"X-FRAME-OPTIONS":["SAMEORIGIN"],"MicrosoftSharePointTeamServices":["15.0.0.4420"],"X-Content-Type-Options":["nosniff"],"X-MS-InvokeApp":["1; RequireReadOnly"],"Cache-Control":["max-age=0, private"],"Date":["Mon, 04 Feb 2013 15:55:21 GMT"],"Server":["Microsoft-IIS\/8.0"],"WWW-Authenticate":["NTLM"],"X-AspNet-Version":["4.0.30319"],"X-Powered-By":["ASP.NET"]} Der HTTP-Antwortinhalt konnte nicht gelesen werden. "Error while copying content to a stream.". bei Microsoft.Activities.Hosting.Runtime.Subroutine.SubroutineChild.Execute(CodeActivityContext context) bei System.Activities.CodeActivity.InternalExecute(ActivityInstance instance, ActivityExecutor executor, BookmarkManager bookmarkManager) bei

In the ULS logs I can find the error "Permission check failed. asking for 0x10000, have 0x2000000000", coming from "Authentication Authorization" which I find pretty weird (what permissions are 0x10000 etc.).

When I set the user trying to execute the workflow as site collection administrator, the workflow runs through smoothly.

02.04.2013 16:24:43.64  w3wp.exe (0x1594)       0x0E04  SharePoint Foundation Authentication Authorization    ag6al                Medium              OAuth app principal Name=i:0i.t|ms.sp.ext|21c57850-ff6e-4fb6-9aa4-201733bf3f18@6a9b095b-7157-4a94-96f2-a27dd438b36d, IsAppOnlyRequest=False, UserIdentityName=0#.w|testdomain\testoffice11, ClaimsCount=18       c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.64  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation CSOM   agw10   Medium              Begin CSOM Request ManagedThreadId=34, NativeThreadId=4840   c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation Logging Correlation Data             xmnv                Medium              Site=/   c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation Authentication Authorization    ag69m                Medium              TenantScopedPerm=0, AllowAppOnlyPolicy=False, AppId=i:0i.t|ms.sp.ext|21c57850-ff6e-4fb6-9aa4-201733bf3f18@6a9b095b-7157-4a94-96f2-a27dd438b36d.    c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation Authentication Authorization    ajmmu                Medium              Permission check failed. asking for 0x10000, have 0x2000000000             c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation General               ftd0       Medium                Access Denied. Exception: Es wurde versucht, einen nicht autorisierten Vorgang auszuführen., StackTrace:   bei Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex)     bei Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask)     bei Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest()     bei Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1 pendingDisposableContainer)     bei Microsoft.SharePoint.Client.ClientRequestService.ProcessRestQuery(Stream inputStream)     bei SyncInvokeProcessRestQuery(Object , Object[] , Object[] )     bei System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)     bei System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)     bei System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)     bei System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)     bei System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)     bei System.ServiceModel.Dispatcher.ChannelHandler.DispatchAndReleasePump(RequestContext request, Boolean cleanThread, OperationContext currentOperationContext)     bei System.ServiceModel.Dispatcher.ChannelHandler.HandleRequest(RequestContext request, OperationContext currentOperationContext)     bei System.ServiceModel.Dispatcher.ChannelHandler.AsyncMessagePump(IAsyncResult result)     bei System.Runtime.Fx.AsyncThunk.UnhandledExceptionFrame(IAsyncResult result)     bei System.Runtime.AsyncResult.Complete(Boolean completedSynchronously)     bei System.Runtime.InputQueue`1.AsyncQueueReader.Set(Item item)     bei System.Runtime.InputQueue`1.EnqueueAndDispatch(Item item, Boolean canDispatchOnThisThread)     bei System.Runtime.InputQueue`1.EnqueueAndDispatch(T item, Action dequeuedCallback, Boolean canDispatchOnThisThread)     bei System.ServiceModel.Channels.SingletonChannelAcceptor`3.Enqueue(QueueItemType item, Action dequeuedCallback, Boolean canDispatchOnThisThread)     bei System.ServiceModel.Channels.HttpPipeline.EnqueueMessageAsyncResult.CompleteParseAndEnqueue(IAsyncResult result)     bei System.ServiceModel.Channels.HttpPipeline.EnqueueMessageAsyncResult.HandleParseIncomingMessage(IAsyncResult result)     bei System.Runtime.AsyncResult.SyncContinue(IAsyncResult result)     bei System.ServiceModel.Channels.HttpPipeline.EmptyHttpPipeline.BeginProcessInboundRequest(ReplyChannelAcceptor replyChannelAcceptor, Action dequeuedCallback, AsyncCallback callback, Object state)     bei System.ServiceModel.Channels.HttpChannelListener`1.HttpContextReceivedAsyncResult`1.ProcessHttpContextAsync()     bei System.ServiceModel.Channels.HttpChannelListener`1.BeginHttpContextReceived(HttpRequestContext context, Action acceptorCallback, AsyncCallback callback, Object state)     bei System.ServiceModel.Activation.HostedHttpTransportManager.HttpContextReceived(HostedHttpRequestAsyncResult result)     bei System.ServiceModel.Activation.HostedHttpRequestAsyncResult.HandleRequest()     bei System.ServiceModel.Activation.HostedHttpRequestAsyncResult.BeginRequest()     bei System.ServiceModel.Activation.HostedHttpRequestAsyncResult.OnBeginRequest(Object state)     bei System.ServiceModel.AspNetPartialTrustHelpers.PartialTrustInvoke(ContextCallback callback, Object state)     bei System.ServiceModel.Activation.HostedHttpRequestAsyncResult.OnBeginRequestWithFlow(Object state)     bei System.Runtime.IOThreadScheduler.ScheduledOverlapped.IOCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* nativeOverlapped)     bei System.Runtime.Fx.IOCompletionThunk.UnhandledExceptionFrame(UInt32 error, UInt32 bytesRead, NativeOverlapped* nativeOverlapped)     bei System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32 errorCode, UInt32 numBytes, NativeOverlapped* pOVERLAP)  .           c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation CSOM   afxwb   High                System.UnauthorizedAccessException: Es wurde versucht, einen nicht autorisierten Vorgang auszuführen.     bei Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex)     bei Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask)     bei Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest()     bei Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1 pendingDisposableContainer)  c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Foundation CSOM   agmjp   High       Original error: System.UnauthorizedAccessException: Es wurde versucht, einen nicht autorisierten Vorgang auszuführen.     bei Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex)     bei Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask)     bei Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest()     bei Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1 pendingDisposableContainer)  c0c2fcc9-abfb-6e2b-f229-68417fb5815c
02.04.2013 16:24:43.66  w3wp.exe (0x1594)       0x12E8  SharePoint Portal Server             Microfeeds        aizmo                Medium              SocialRESTExceptionProcessingHandler.DoServerExceptionProcessing - SharePoint Server Exception [System.UnauthorizedAccessException: Es wurde versucht, einen nicht autorisierten Vorgang auszuführen.     bei Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex)     bei Microsoft.SharePoint.SPSecurableObject.CheckPermissions(SPBasePermissions permissionMask)     bei Microsoft.SharePoint.Client.SPClientServiceHost.OnBeginRequest()     bei Microsoft.SharePoint.Client.Rest.RestService.ProcessQuery(Stream inputStream, IList`1 pendingDisposableContainer)] c0c2fcc9-abfb-6e2b-f229-68417fb5815c

I tried giving the user trying to execute the workflow Site Owner permissions, Site Reader or Site Contributor - in all cases the workflow fails. Only a site collection administrator (the user or another admin) can start a workflow.

Edit: I looked into the SPBasePermissions. The error is actually saying "Permission check failed. asking for "Open", have "UseRemoteAPIs"".

Improve this question
2
  • Dennis, can you clarify this? Did you change the group memberships as well as run the UPS? Are you perhaps saying you created duplicate groups with identical access, so you could put the users from one OU in one group and users from the other OU in the other group?
    – ron b
    May 5, 2014 at 19:09
  • As I stated in my answer below: The problem was with the AD group being moved from one OU to another OU. Permissions were not altered, only the location of the group. The 401 was resolved by running UPS as I understand it updates the group memberships and hence updates the security tokens.
    – Dennis G
    May 6, 2014 at 13:55

1 Answer 1

Reset to default
2

The problem was related to the OU the users where in.

My main OU was at DOMAIN > MainOU > SubOU - in that OU are all my SharePoint groups and users. Let's take the "SharePoint Users" group as an example in that OU. It has permissions to contribute on the SharePoint.

I now had a different OU at DOMAIN > DifferentOU for test users. I gave these test users permissions on SharePoint by putting them also in the SharePoint Users group.

This is what was causing the problem:
When adding users in the same AD branch (same OU) everything is fine. But once users come from a different parallel branch (different OU), somehow the security doesn't work and I get the said error message.

To solve the problem I only had to run the User Profile Synchronization.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.