Re: Impersonation problem in Sharepoint 2007
- From: jerome.decouenne@xxxxxxxxx
- Date: 2 Aug 2006 06:58:27 -0700
Hi again everybody,
I post again because we still have the impersonation problem and here
are more details about the problem.
We use the following example to do our tests : in a custom navigation
provider, we want to determine if the current page is the default page
of the current Web. So we have to get
"SPContext.Current.Web.RootFolder.WelcomePage" and here is the problem!
The user needs elevated privileges to get this Welcomepage... We have
tested a lot of things to impersonate our current user but nothing
worked (retrieving this WelcomePage and everything else that needs
privileges...). Each time we catch "Access denied" errors.
We have tested:
- Impersonate method with Duplicate Token (which we always used with
Sharepoint 2003) :
brievly :
IntPtr token = WindowsIdentity.GetCurrent().Token;
DuplicateToken(token,
SecurityImpersonationLevel.SecurityImpersonation, ref token) // from
advapi32.dll
WindowsIdentity _appPoolIdentity = new
WindowsIdentity(token);
WindowsImpersonationContext _selfContext =
WindowsIdentity.Impersonate(IntPtr.Zero);
WindowsImpersonationContext _context =
_appPoolIdentity.Impersonate();
// my code
_selfContext.Undo();
_context.Undo();
- Impersonate method with RevertToSelf :
brievly :
WindowsIdentity impersonatedUserIdentity =
WindowsIdentity.GetCurrent();
Win32API.RevertToSelf() // from advapi32.dll
WindowsIdentity.GetCurrent().Impersonate();
// my code
impersonatedUserIdentity.Impersonate();
- SPSecurity.RunCodeWithElevatedPrivileges method :
brievly :
SPSecurity.CodeToRunElevated myDelegate = new
SPSecurity.CodeToRunElevated(MyCodeMethod);
SPSecurity.RunWithElevatedPrivileges(myDelegate);
/*...*/
public void MyCodeMethod()
{
// my code
}
- We tried too, to play with the current Identity of the HttpContext.
Each time, the impersonation is correctly realised and each time we
have "Access Denied" errors.
I want to precise that we only want to elevate the current user
privileges so that he can do administrators actions without giving him
the admin rights. Maybe the impersonation is not the way to do so.
Can somebody help us?
PS : the Sharepoint site is running under Windows 2003 with Integrated
Authentication. The appPool user is admin of every front servers and
database server and he is member of the groups : wss_admin_wpg,
wss_restricted_wpg and wss_wpg
jerome.decouenne@xxxxxxxxx wrote:
Hello,
It's been four days that we are looking for something to help us, but
we're still having problems getting it to work.
The thing we are trying to do is to grant temporarly rights to the
connected user, in order to use a Sharepoint method that demand
administrator privileges, such as create SPWebs, SPLists and
SPListItems or retrieve the WelcomePage of a SPWeb.
The first thing we thought is the classical Impersonate method, used in
SPS 2003. But it doesn't work!
We thought then, that it was the problem of the "Roles retrieval" in
SPS 2003, which forces to use AppDomains. But this solution is not
suitable because everything we try causes an Access Denied Exception.
There must be anything else.
When we impersonate, the WindowsIdendity associated to the context
correctly becomes the AppPool Identity (checked with Debug). But it
seems that the security context on which MOSS is based, is still the
user's one (checked by using its API : for example,
SPContext.Current.Web.CurrentUser is a SPUser
corresponding to the one is connected). This seems to have for
consequences that even in a impersonated block, if we create a new
list, the creator of the list is the logon user, not the current user
of the HttpContext!
Has anyone gotten this to work? Am I forgetting something?
Thanks for your reply
Jérôme D.
.
- Follow-Ups:
- Re: Impersonation problem in Sharepoint 2007
- From: Jeev
- Re: Impersonation problem in Sharepoint 2007
- References:
- Impersonation problem in Sharepoint 2007
- From: jerome . decouenne
- Impersonation problem in Sharepoint 2007
- Prev by Date: Access to a List
- Next by Date: Re: SharePoint Search - Wildcard and Scope
- Previous by thread: Impersonation problem in Sharepoint 2007
- Next by thread: Re: Impersonation problem in Sharepoint 2007
- Index(es):
Relevant Pages
|
