Access Denied when trying to set formdigestsettings in a list event receiver even when logged in as Farm Administrator account

Question

I am trying to set the formdigestsettings to false within an event receiver (sharepoint 2010). So far I have tried to a) run the code with elevated privileges

public override void ListAdded(SPListEventProperties properties)
{
   SPSecurity.RunWithElevatedPrivileges(delegate()
   {
        using (SPSite site = new SPSite(properties.SiteId))
        {
            using (SPWeb web = site.OpenWeb())
            {
                SPWebApplication webApp = site.WebApplication;
                webApp.FormDigestSettings.Enabled = false;
            }
        }
   }
}

I am getting Access Denied on this line-

webApp.FormDigestSettings.Enabled = false;

b) create the SPSite using the Farm Administrator account usertoken

public override void ListAdded(SPListEventProperties properties)
{
   properties.Web.AllowUnsafeUpdates = true;
   SPUser FarmAdminAccount = properties.Web.EnsureUser(@"DOMAIN\farm.account");
   properties.Web.AllowUnsafeUpdates = false;

   using (SPSite site = new SPSite(properties.SiteId, FarmAdminAccount.UserToken ))
   {
       using (SPWeb web = site.OpenWeb())
       {
           SPWebApplication webApp = site.WebApplication;
           webApp.FormDigestSettings.Enabled = false;
       }
   }
}

In this case also the code gave an Access Denied error on this line- webApp.FormDigestSettings.Enabled = false;

c) lastly I tried to login to the sharepoint website using the Farm Administrator account and password and then also I got the Access Denied error.

IN each of the 3 cases when i checked the web.CurrentUser.LoginName it always displayed as SHAREPOINT\system.

Can somebody please give some ideas?

---

----------------------UPDATE------------------------------

Hi

What I am actually trying to do is to attach the OOTB sharepoint workflow [Approval Sharepoint - 2010] to each and every document library that ever gets created. To accomplish this I created a List Added event reciever and put this code in it -

public override void ListAdded(SPListEventProperties properties)
{
   SPSecurity.RunWithElevatedPrivileges(delegate()
   {  
       SPUtility.ValidateFormDigest();

        using (SPSite site = new SPSite(properties.SiteId))
        {
            using (SPWeb web = site.OpenWeb())
            {
                try
                {
                    base.ListAdded(properties);
                    if (currentList is SPDocumentLibrary)
                    {
                        SPDocumentLibrary docLib = (SPDocumentLibrary)properties.List;


                        //workflows need a tasks and history list. Here we assume they exist
                        SPList taskList = web.Lists["Tasks"];
                        SPList historyList = web.Lists["Workflow History"];

                        //loop through the workfows in the web and grab the one we want by name
                        SPWorkflowTemplate wfTemp = null;
                        foreach (SPWorkflowTemplate wt in web.WorkflowTemplates)
                        {
                            if (wt.Name == "Approval - SharePoint 2010")
                            {
                                wfTemp = wt;
                                Common.AddToLog(web, "Found " + wt.Name + " in current web " +
                                web.Url, false);
                                break;
                            }
                        }

                        //Now add the workflow to the doc library
                        SPWorkflowAssociation workFlow = SPWorkflowAssociation.CreateListAssociation(wfTemp, wfTemp.Name, taskList, historyList);

                        workFlow.AllowManual = true;
                        workFlow.AutoStartChange = false;
                        workFlow.AutoStartCreate = true;
                        workFlow.AssociationData = null;

                        web.AllowUnsafeUpdates = true;
                        web.ValidateFormDigest();
                        docLib.WorkflowAssociations.Add(workFlow);                                

                        docLib.EnableModeration = true;

                        docLib.Update();
                        web.Update();
                        web.AllowUnsafeUpdates = false;
                    }
                }
                catch (Exception ex)
                {
                    throw ex;
                }
                finally
                {
                    web.AllowUnsafeUpdates = false;
                }
            }
        }
   });
}

I was getting this error -

The security validation for this page is invalid. Click Back in your Web browser, refresh the page, and try your operation again.

at this line

docLib.WorkflowAssociations.Add(workFlow);

To resolve that error I did some research and founds some blogs where it was recommended to set the FormDigestSettings of the webapplication to false. But that did not work because I was getting the Access Denied error.

Does anybody have any suggestion for the security error. It seems like a very common thing to do (i.e. attach a workflow to a sharepoint List, don't know why I should be having so much trouble with this)

Answer 1

public override void ListAdded(SPListEventProperties properties)
{
    SPUtility.ValidateFormDigest();

    SPSecurity.RunWithElevatedPrivileges(delegate()     
    {         
         using (SPSite site = new SPSite(url))         
         {             
            using (SPWeb web = site.OpenWeb())            
            {                
               //do what you want here
            }
        }
   }
}

If the method that is passed to the RunWithElevatedPrivileges method includes a write operation, either of the SPUtility.ValidateFormDigest() or SPWeb.ValidateFormDigest() methods should be called before a call is made to RunWithElevatedPrivileges.

http://msdn.microsoft.com/en-gb/library/microsoft.sharepoint.utilities.sputility.validateformdigest(v=office.14).aspx

any reason why you want to turn it off? the above method will handle it for you!

Answer 2

Your code seems to run in a "List Added" event receiver: that means that the code is executed at the scope of a site collection/web site.

The property you are trying to change, "FormDigestSettings", is defined on the SPWebApplication object. You basically need to change a web application level setting from a simple site context - and that is blocked by default on SharePoint 2010.

SharePoint 2010 introduced a new security setting called "RemoteAdministratorAccessDenied" - this setting has the effect to block any attempt to modify a web application property from a site collecton or web site scope. To quote Microsoft

"This feature explicitly blocks any modifications to the objects inheriting from SPPersistedObject in the Microsoft.SharePoint.Administration namespace and does not allow the content web applications to update the configuration database"

[related kb article here]

You have two options here:

1. Refactor your application logics so that you don't need to change that property from inside the site collection. If you could for example move the setting to a web application scoped feature it should work.

2. Disable the security setting. The knowledge base article that I linked provides a PowerShell script to do that. Be aware that doing this is not suggested in a production environment because you would actually disable one of the security layers provided by SharePoint to block potentially dangerous code.