1

So there's lots of articles about pros/cons of different configuration options, e.g. http://msdn.microsoft.com/en-us/library/ee855123(v=office.12).aspx

We are using a combination of property bags (generally on the RootWeb) and a couple lists. A problem arises when there are users who have permissions only to a subsite - they can't read the property bags, or the lists, so they get an access denied.

I see two solutions: give All Authenticated Users read permissions to the lists, which implicitly gives them limited access to the RootWeb, which is enough to read properties, or elevating permissions (i.e. load the site as system account) to read the properties. Which is preferable, assuming it's something that needs to happen a lot in the SharePoint site? I assume that if I go with the elevating permissons route that I am going to want to organize my code such that I don't need to elevate several different times in one request?

I've got another question on some of the specifics of adding all authenticated users here: Programatically adding All Authenticated Users

3

I apologize for this post, because this is opinion based only. Opinion based on experience, however, but nevertheless - opinion.

I'd go down the path of giving All Authenticated Users read access instead of elevating to some administrator level. One problem with elevating to admin is that SharePoint "help"s your code to not be your admin but rather the account of SHAREPOINT\system. This is hell if you rely on an admin user having a profile with a mysite for instance.

So please please please, avoid elevation if you can, and your admin (namely me) will give you eternal love.

3

A variation would be to instead impersonate an account that are setup for this special use, with the needed permissions on the root web.

But in this scenario I do not really see the problem with giving the users read access on the list. So I agree fully with @Benny Skogberg in this scenario, although noting that there are scenarios where elevating privileges is the best approach.

  • True that! Use a specific account, and your admin will agree on the implementation. But be very sure that the implementation of elevation does just that, and nothing else. +1. – Benny Skogberg Jul 4 '13 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.