2

I am investigating the below code to make sure if its quality is as per Microsoft standards. Actually Comments came from Microsoft code reviewer that we need to create new SPSite Object within the elevated code in delegate. //ExtranetManager is my custom class

I Investigated and have tried to fix but i don't believe that anything wrong with this code. I want to take help from experts in this forum if any body can give good comment about that code or if there is something wrong within elevated privileges. Any comment can help me that may be i am missing. 

public class MyTimerJob : SPJobDefinition
        {
           public override void Execute(Guid targetInstanceId)
            {
                SPWebApplication wa = null;

                  wa = (SPWebApplication)base.Parent;
                    SPSecurity.RunWithElevatedPrivileges(delegate
                    {
                        ExtranetManager extranetManager =
                          new ExtranetManager(wa);
                        extranetManager.StartSynchronization();
                    });
               }
        }
Improve this question
1
  • 1
    Are you using and SPSite or SPWeb objects inside the ExtranetManager class? if yes, you need to instantiate them afresh. Commented Feb 17, 2016 at 13:00

2 Answers 2

Reset to default
0

RunWithElevatedPrivileges only works if the current thread is using impersonation, i.e. IIS. Used in other code (timer jobs, console applications, workflow, etc.) it will have no effect. Colin is correct that by default the timer service runs as the farm service account specified in the Configuration Wizard. You can verify this in Windows Services.

Source

Improve this answer
3
  • I can't speak for timer jobs or workflow, or technically console applications either but I'm developing a winforms application - which should have basically the same execution context as a console app (the user that starts the application) - and it can't do certain things without a RunWithElevatedPrivileges delegate, and then of course getting a new SPSite in the new elevated context. Do you have a source that shows how that's not necessary? Commented Feb 17, 2016 at 17:46
  • I guess I'll cut and paste my comment to your "source" as well... Commented Feb 17, 2016 at 17:49
  • I'll try and find an authentic source, but have you tested if the RWEP actually works in WinForms, I remember trying to use it in console app which didn't have any effect whatsoever. Had to instantiate new SPSite using SPUserToken of the SystemAccount. What RWEP does is that it creates a new thread with the security context of the user running the Application Pool which in case of WinApp/ConsoleApp would be that of the User running the app effectively having no effect whatsoever. Commented Feb 18, 2016 at 6:12
7

The actual point is: there's no need at all to use SPSecurity.RunWithElevatedPrivileges in a job.
A job runs in OWSTIMER.exe, which uses the "SPFarm" account. "SPFarm" account has all privileges against all content DBs; it's seen as "system account" everywhere. So there's really no need to elevate its privileges at all.

However, as a side note, code inside SPSecurity.RunWithElevatedPrivileges must use new fresh SharePoint objects (i.e. new SPSite):

  • A new SPSite must be explicitely open from the elevated section, so its flagged with the elevated identity.
  • All SharePoint objects used inside the elevated section must come from that new SPSite, while it's kept open.
  • This new SPSite must be built and closed from the elevated section.
  • After it's closed, you can't use any of the "child" object anymore.

In the case of your code, and assuming it really needs an elevation context (i.e. let's assume it's not in a job as it actually is): the following code must open and close SPSite objects with respect to previous rules: 

ExtranetManager extranetManager = new ExtranetManager(wa);
extranetManager.StartSynchronization();
Improve this answer
2
  • Add a because why, and this will be a great answer Commented Feb 17, 2016 at 13:11
  • Sorry, was about to complete my answer, when I got a call :) I'm back on it! Commented Feb 17, 2016 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.