Please help me.

In our company, we developed an application under the Apple device to work with the company's internal services , including it in this application it is possible to send messages to the corporate blog portal, which is deployed on Sharepoint 2013 .

The application architecture is as follows:

Server on which you installed Sharepoint 2013 is called "SPS01", on the same server is deployed on IIS web application called "WS", application "WS" taken in a separate application pool from Sharepoint 2013 .

All Apple client devices communicate with Sharepoint 2013 through the web application "WS". For us it is important that when applying for Sharepoint 2013 with mobile devices, Apple remained the security context of the authenticated user, as access to documents stored in Sharepoint 2013 demarcated .

For what would be maintained security context authenticated users , we applied techniques such as impersonation and kerberos .

Request goes like this:

Apple client connects to the Web application "WS", on the "WS" configured to connect to Kerberos enabled and impersonation . (Apple iOS 7 support kerberos ) , then all customer interaction with Sharepoint 2013 going through "WS". Kerberos we use that to get rid of the problem of "double hopes" that occur when a web application "WS" refers to the other network resources that are beyond the server "SPS01".


Web application "WS", which is on the server "SPS01", refers to a file server «FS01», to get a list of documents from the usual file balls through kerberos and impersonation request comes on «FS01» from the user who is authenticated by web application «WS».

But there was a problem:

If the user enters the Sharepoint 2013 through the browser on your computer, it can successfully keep there blog post .

If the user is drawn to Sharepoint 2013 from a mobile device Apple, and tries to leave a message in the blog , the error appears : Access Denied. Exception: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))

Empirically by the following was revealed: I tried to give you a right to - it did not help:

  1. Administrator farm
  2. SQL database config and content - owner
  3. Administrator of User Profile Services
  4. Local Administrator


When deploying Sharepoint 2013 group was created security domain - "domain \ farm_administrators" - which is in the local group Sharepoint 2013 - "Farm Administrators" If the user is included in the domain security group - "domain \ farm_administrators", then the user can successfully keep a blog post from a mobile device Apple.

I want to note that this happens only through security group AD «domain \ farm_administrators»

The question is, how can you determine what rights the special security group "domain \ farm_administrators" in Sharepoint 2013 , whereby the participants can successfully send messages to the blog with Apple mobile devices via the web application "WS".

We also found a workaround , but it will not work as we would like.



We can execute a part of the Web application "WS" with the highest privileges. In this case, the user was able to successfully send a message to your blog from your mobile device Apple.

But when the code runs with the highest privileges - lost the security context of the authenticated user.

In the author is shown as "System Account"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.