Have Geek Brain

Accessing a SharePoint List in Application Pools

I have a requirement where I need to be able to access a list that is in central administration from an application page that is in my web interface (WFE). The problem is the app pool user for my WFE doesn't have access to the SharePoint_AdminContent database, so I get access denied, both have their own app pools

The logs show the following:

  • Reverting to process ID
  • Current user before SqlConnection.Open: Name: SharePointDemo \ SPContentPool SID: S-1-5-20 Impersonation: none
  • Current user after SqlConnection.Open: Name: SharePointDemo \ SPContentPool: S-1-5-20 Impersonation: none
  • Insufficient SQL database permissions for user "SPContentPool" on database "SharePoint_AdminContent_53169fb3-137c-44b2-b90e-961b656e4275" on SQL Server instance "SPNSQL". Additional error information from SQL Server is included below. EXECUTE permission was denied on object 'proc_EnumLists', database 'SharePoint_AdminContent_53169fb3-137c-44b2-b90e-961b656e4275', schema 'dbo'.

I tried to start new privileges and also try Daniel Larson's method ( http://daniellarson.spaces.live.com/blog/cns!D3543C5837291E93!1919.entry ) which uses the SharePoint \ System user token, but it only seems to go up as high as the application pool.

I hope there is an easy way to impersonate the application pool in the admin web app, but haven't been able to find a way to do this yet ... Or change the process id to someone who has access

Any thoughts, ideas or solutions are happily accepted!

Phill

+1


a source to share


3 answers


The problem is that the CA application pool and WFE application pool are most likely running under different accounts, which is best annoying when you are a developer. There are no Elevating privileges you can do using SPSecurity.RunWithElevatedPrivileges to get around this.

Security policy provisioning allows this, you can provide the application pool that runs your WFE web application with the same credentials as the administration application pool.

This can be done using the Service Accounts screen at:



Http: ///_admin/FarmCredentialManagement.aspx

If you go down the web service route, you might need a native web service role to prevent too many "chats" over HTTP.

+1


a source


You should try to use the list web service to access the list items. And set credentials before connecting to the web service.



+6


a source


Have you tried the regular window impersonation ? You can probably probably impersonate the service account and access the list.

+1


a source






More articles:


All Articles