0

I have an External Content Type created. It connects to a SQL Server 2005 db, using "Impersonate Windows Identity" authentication, with an account over in Secure Store Service. I've got a Read List and Read Item action defined. I created a BDC Profile Page. I created an External List, based on the External Content Type. It all works perfectly. For me.

Others, however, they get "Access Denied". I picked an individual user and in vain tried granting the other user all four permissions (Edit, Execute, Set Permissions, Selectable in Clients) on both "Set Object Permissions" and "Set Metadata Store Permissions" over in BDC. I did this for the BDC Model, the External System, and the External Content Type. As far as the "View External Content Types" page in Central Admin > BDC goes, they have it all. And yet they still get denied. This is true for the External List, and the BDC Profile Page with a works-for-me URL picking a specific item from the external data.

I tried placing the 'other user' into the "Owners" group in the site collection holding the External LIst based on the ECT. No luck. I verified that group has "use remote objects" in its permission level. As far as I can tell, this account has all the permission one could it. Yet no access to the BDC. Any suggestions? This is SP2010 Server.

|improve this question|||||
1

It sounds like a Secure Store Service Application issue rather than the BDC Service Application.

Make sure that the Secure Store Application ID has the appropriate members (the ID that you used for Impersonate Windows Identity). Go to Central Admin - Secure Store Service - Manage - click on the target application - edit- click next- and add all of the users who will need permission to access the external content type to"members".

enter image description here enter image description here

|improve this answer|||||
  • It should look almost identical in 2010. Here is a 2010 screen shot that I just googled for: social.technet.microsoft.com/wiki/cfs-filesystemfile.ashx/__key/… Make sure that you have chosen the proper secure store Target Application/group and chosen edit for that. I will adjust my answer to include a screen shot. – TigerBear Mar 18 '14 at 16:59
  • Your screenshot is for SP2013, but the same answer applies for SP2010. In my case, I was, in vain, picking "Set Permissions" in SSS. You don't get to see the "Members" box there. Instead, you have to click on the name of the Target Application ID, and walk through the setup steps until you get to the screen similar to the one you show above. That fixed everything, thank you. – Alan M Mar 18 '14 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.