Re: Webpart to create new subweb and a list item

From: Mikael Andreasen (anonymous_at_discussions.microsoft.com)
Date: 07/28/04


Date: Wed, 28 Jul 2004 09:11:25 -0700

Well, it seems I'm baniging my head against the wall
here...

The Create Subweb part works great when I bypass the
impersonation and log in as an administrator.
When I turn impersonation on, I'm prompted to
authenticate, but the login always fails.
However, if I comment out the code which requires
administrative privileges (the create subweb part) and
just impersonate and the undo, everything works with no
errors. In other words, the impersonateValidUser method
returns true, but when I try to excercise the
administrative privileges I either a) Don't have them, or
b) Haven't been authenticated properly.

As the user I'm trying to impersonate is an admin on the
server as well as in SharePoint, I'm leaning towards the
latter.
A few points:

1) I've had to add the following lines in order to avoid a
security error when creating the subweb:

SPGlobalAdmin globalAdmin = new SPGlobalAdmin();
Page.RegisterHiddenField("__REQUESTDIGEST",
globalAdmin.AdminFormDigest);
mySite.AllowUnsafeUpdates = true;
myWeb.AllowUnsafeUpdates = true;

- I can't see how that should affect the impersonation,
though.

2) According to Microsoft, the process which does the
impersonation must be granted the "Act as part of the
operating system" - I did this, but to no avail.

I'm really at loss as to what can be wrong - I think it
_might_ be related to authentication method / security
settings or something similar, rather than the actual
code - but I have no idea what to try.

Any help anyone could offer would be just fantastic.

Thanks in advance!
/Mikael Andreasen

>-----Original Message-----
>Thanks for your reply!
>
>I turned off impersonation, and am now able to create
>subwebs using an admin account. Woohoo :)
>Funny thing is, even though the user I try to impersonate
>is administrator of both the server and the Sharepoint
>root web, I still receive a login prompt (which always
>fails to authenticate).
>
>Anyway, I do have some progress now, and will look into
>the impersonation thing over/after the weekend.
>Thanks again for your help.
>
>/Mikael Andreasen
>
>
>>-----Original Message-----
>>Sorry - Haven't checked the ng for a couple days.
>>I cannot remember if I encountered that exact problem.
>>2 debugging tips
>>1 Remove impersonation from the mix and just run the
>as an admin
>> This will ensure that you have the priviledges all
>set up.
>> 2 Look into running in debug mode - interactive debug
>is a nice addition
>>to VS 2003
>> You have to attach to the W3WP process on the
>server
>> I have done this remotely and locally and locally
>is easier if
>>possible.
>> The trickiest thing with permissions is that you need
>permissions to create
>>the subweb under a site, but you also need permissions
to
>the root site to
>>access the global template(s).
>>
>>"Mikael Andreasen" <anonymous@discussions.microsoft.com>
>wrote in message
>>news:15af01c46f32$434c2c50$a301280a@phx.gbl...
>>> Ok, I'm sorry about constantly asking questions, but
I'm
>>> kinda stuck here.
>>> I managed to compile and install the web part, but now
>I'm
>>> getting the following error:
>>>
>>> Object reference not set to an instance of an object.
>>> Microsoft.SharePoint
>>>
>>> I messed a bit with the userId, password and domain
>>> variables to get this far, so I think the impersonation
>>> works fine, but I have no idea what is causing this
>error.
>>> Again, any help would be greatly appreciated.
>>>
>>> Thanks in advance!
>>> /Mikael Andreasen
>>>
>>> >-----Original Message-----
>>> >Hmm, I'm having problems getting the code to compile
>(it
>>> >won't recognize the Microsoft.SharePoint namespace).
>>> >I'm sure I'm missing something very basic, but as I'm
>>> very
>>> >new to writing custom webparts, any help at all would
>be
>>> >appreciated.
>>> >
>>> >Thanks in advance!
>>> >/Mikael Andreasen
>>> >
>>> >>-----Original Message-----
>>> >>Thanks guys, I really appreciate it!
>>> >>
>>> >>David: Thanks for the code and the comments,
>hopefully I
>>> >>can make some sense of it.
>>> >>
>>> >>Jason: I'll drop you a line.
>>> >>
>>> >>
>>> >>>-----Original Message-----
>>> >>>i also posted complete C# code a week or two back
>>> >>>here it is again
>>> >>>(i even added a feew comments - i don't do that for
>>> just
>>> >>anybody;)
>>> >>>i found that the web part might need to be run by or
>>> >>impersonate a local
>>> >>>administrator for the list to be visible in the site
>>> web
>>> >>part gallery
>>> >>>there is also this little flag ... site content
admin
>>> or
>>> >>some such
>>> >>>
>>> >>>fun stuff!
>>> >>>"Jason Dever" <JasonDever@discussions.microsoft.com>
>>> >>wrote in message
>>> >>>news:433E3873-351E-40DE-B420-
>>> >9A0C4F43CE7A@microsoft.com...
>>> >>>> I just finished work on this. I will be posting
it
>>> on
>>> >>my new blog once I
>>> >>>get it up and running next week.
>>> >>>>
>>> >>>> If you need to see something sooner, email me.
>>> >>>> --
>>> >>>> Jason Dever, MCP
>>> >>>> Adapt IT
>>> >>>>
>>> >>>>
>>> >>>> "Mikael Andreasen" wrote:
>>> >>>>
>>> >>>> > Hi,
>>> >>>> >
>>> >>>> > I would like to build a webpart that does the
>>> >>following:
>>> >>>> > 1) Lets users fill out a form with X input
fields
>>> >>>> > 2) Creates a new subweb (based on a template)
>>> >>>> > 3) Creates a new list item (using data from the
>>> form
>>> >>+ url
>>> >>>> > of the new subweb)
>>> >>>> >
>>> >>>> > However, I have no experience in writing web
>parts,
>>> >>so I'm
>>> >>>> > not sure how to go about this.
>>> >>>> >
>>> >>>> > Any help / suggestions / links etc. would be
>greatly
>>> >>>> > appreciated!
>>> >>>> >
>>> >>>> > Thanks in advance,
>>> >>>> > /Mikael Andreasen
>>> >>>> >
>>> >>>
>>> >>>
>>> >>>
>>> >>.
>>> >>
>>> >.
>>> >
>>
>>
>>.
>>
>.
>



Relevant Pages

  • Re: Thread identity
    ... both approaches using impersonation will get you in trouble - ... when an attacker can take over the application - he is admin ... > The WindowsImpersonationContext starts and stops impersonation. ... > only other thing is getting the logon token for the administrator to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Thread identity
    ... > Hello Joe, ... > both approaches using impersonation will get you in trouble - ... > when an attacker can take over the application - he is admin ... >> you can run the worker process as the administrator and undo the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: FindFirstFile and Impersonation
    ... token impersonation level would be "Delegation"). ... authenticate to other sites using his credentials on the network. ... You need to change whatever mechanism you used to authenticate your client ...
    (microsoft.public.platformsdk.security)
  • Solution: Asp.Net and Smb shares - without impersonation
    ... At first glance, everyone seems to suggest using the "identity" tag in ... Impersonation is overkill. ... then I do the "net use" call to authenticate and try again. ... exception, then the file will actually not exist, and you get this error: ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Programmatic Subsite Creation
    ... I working with a webpart and have I tried impersonation of the admin, ... I ended doing a work around by creating a site template for the top level ... > untighten your portal security trust level in web.config too. ...
    (microsoft.public.sharepoint.portalserver.development)