Jun 052008
 

Since I’ve been ranting on this for a few days, I thought I’d wrap it up. When SPSecurity was first found, we thought it was the best thing in the API since since SPPeanutButter. We used it… we abused it… we loved it. Over the course of the last few months though, it betrayed us. We started to see all sorts of obscure bugs when working with the SharePoint object model within the delegate in RunWithElevatedPrivelege. One such issue was with My Sites. Somehow, we managed to abuse SPSecurity.RunWithElevatedPrivilege enough to disable MySite creation in the current ASP.NET application in completely unrelated code. Through simple calls sent through RunWithElevatedPrivilege we were able to corrupt the ASP.NET application instance so that MySites could not be created, with another misleading error message on the failed My Site creation page. QA loved this, of course.

As the MSDN documentation says, SPSecurity.RunWithElevatedPrivelege "Executes the specified method with Full Control rights even if the user does not otherwise have Full Control." What it does is it uses the Win32 ImpersonateSelf API method to drop down to the thread’s identity. There’s a lot of hairy native code that’s used to do this… just check out the method with Reflector. What we found was that all SP object model instances need to be created and disposed of inside of the delegate– and even that can cause obscure bugs.

I’m not recommending to never use SPSecurity– but I will recommend to never use SPSecurity to access or manipulate the SharePoint object model. There’s too much overhead, too much chances of introducing obscure bugs, and too much potential abuse. Only us SPSecurity.RunWithElevatedPrivelege to use the application pool’s credentials for network calls. And for that, you may be better off simply using WindowsImpersonationContext and WindowsIdentity.Impersonate(IntPtr.Zero).

For all other impersonation needs, use the SPUserToken to impersonate. Remember that the elevation of the object model happens through the SPSite constructor- no matter which elevation method you use, either through RunWithElevatedPrivilege or though simple impersonation using the user token. 

To impersonate the SYSTEM and use elevated privilege, get the user token from the SYSTEM ACCOUNT. Fortunately, the SystemAccount SPUser is a property of any SPSite object. So instead of using SPSecurity.RunWithElevatedPrivelege, you can use the following code to perform elevated actions:

 

SPUserToken sysToken = SPContext.Current.Site.SystemAccount.UserToken;
using(var systemSite = new SPSite(SPContext.Current.Site.ID, sysToken))
{
    using (var sysWeb = systemSite.OpenWeb(SPContext.Current.Web.ID))
    {
        // Perform elevated actions here
    }
}

  23 Responses to “SharePoint Security: The Evils of RunWithElevatedPrivilege (and our hero, SPUserToken)”

  1. Your rants have kept me laughing. Only because I have experienced obscure errors when using SPSecurity. I also agree that the SPUserToken is the better way to go and has worked well for me.

  2. Daniel, This is very important indeed. Thanks for these thoughts.

  3. hi Daniel,
    Your deep investigation with SPSecurity help us lot. Though, when you loop through all User Profile in your WebPart code. It gives error that, Only an administrator may enumerate through all user profiles. What will be appropriate method to use in that case?
    Thanks

  4. In some cases– there just may be no workaround… but do you NEED to loop through all user profiles in web part code?
     
    Also, I haven’t done deep comparison of just using the WindowsImpersonationContext to switch the thread identity, that may be a better option.

  5. Hi Daniel, I have been following your posts pretty closely and with interest, and think it is pretty good advice. I have been looking to follow it in a recent project I have been working on and think I may have run into some limits. Specifically, I’m creating a Site Collection from a Event Recevier. It seems that no matter what I do I cannot use this mechanism to get the required permissions to do this either using the "SelfServiceCreateSite" method, or via a reference to Sites.WebApplication.Sites.Add. I have confirmed that I’m definitely getting a session which is impersonating the SharePoint System account, but everytime I get back a permissions error.
     
    So, while I would like to avoid use SPSecurity, I dont think I left with too many options. Though I’m going to investigate the use of Windows Impersonation, I dont like the idea of storing a username and password with those permissions somewhere.
     
    Let me know if you have any thoughts,
    Daniel

  6. Hey DanielUse the SPUserToken of the SystemAccount. I posted that a few posts back, but will re-blog a helper class to do this as soon as I get time.

  7. Hey Daniel,
     
    I think I pretty much tried everything, including using the System Account (saw your earlier post), just couldn’t get the Site Collection creation to work without some type of error reporting an issue with permissions.
     
    Unfortunately it didn’t’give me a lot to go on. I also tried impersonating the Owner I was feeding into the SelfServiceCreateSite call, as it seems to care about that (seems that this works without any impersonation, if the person making the call is the same as the owner specified in the parameters) and that didn’t work either.
     
    Anyway, I spent quite a few hours on this, and since it was from an Event Receiver each debugging cylce took longer than usual. Got into one of those weird tailspins where I just wasn’t sure what I had and hadn’t tried yet. The summary is though, that I think I tried everyting! <Grin>
     
    Thanks for your response.
    Daniel

  8. Thanks Daniel, class is great, though I had already written my own! <grin>
     
    What I’m curious about is any limits that might exist with this approach, while its possible I was making some trivial error, in the situation I described below (creating a new *site collection*) this impersonation approach just didn’t work. I hit permission errors every which way I tried. 
     
    I have switched most of my code to using this technique, as you have suggested, and it already "feels" better, but understanding the limits are important too. So wanted to compare notes.
     
    Thanks again for continuing the conversation.
    Daniel

  9. Hmmm… yeah, the new site collection probably may not work as you’ve discovered, as the SPSite object creates the security context. What permission errors did you get? (Make sure that you ALWAYS set the SPSite’s CatchUnauthorizedAccessException to false, otherwise it will "handle" it for you!)  Do you have a code snippet that demonstrates what you’re doing?

  10. As we know, wow gold in world of warcraft game is very important ,if you have more gold ,you can buy wow item ,wow weapon and power your wow character, who will be stronger and stronger. But gold is not easy come by, so you should buy wow gold or buy warcraft gold from us, be a professional free wow gold store have been created for many years, we supply cheap wow gold for local customers. you may find wow gold guide,wow gold tips and buy world of warcraft gold on our website. We have available stock of gold on most of the servers, so that we can do a really instant way of delivery.

  11. Yfdg5df xmgfh7 wow gold wow gold wow gold wow gold 股票软件 股票软件 黑马股推荐 黑马股推荐 大智慧 大智慧 胶体磨 胶体磨 上海水泵 上海水泵 炒股软件 炒股软件 黑马股 黑马股 中高年 転職 中高年 転職 出会い系 出会い系 毛穴 黒ずみ 毛穴 黒ずみ wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold 上海水泵 上海水泵 上海水泵 wow gold wow gold wow gold wow gold wow gold wow gold wow gold

  12. sarsd110 cl512ong wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold 化工泵 化工泵 化工泵 化工泵 隔膜泵 隔膜泵 隔膜泵 隔膜泵 转子泵 转子泵 wow gold wow gold China Travel China Tours China Tours beijing Tours beijing Tours beijing Travel beijing Travel shanghai Tours shanghai Tours shanghai Travel shanghai Travel wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold

  13.  everquest 2 gold eq2 plat ffxi gil final fantasy xi gil gaia online gold gaia gold guild wars gold gw gold hellgate london palladium cabal alz daoc gold daoc plat buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffix gil GW gold buy Guild Wars gold Guild Wars gold buy Lineage 2 adena buy Lineage II adena Lineage 2 adena L2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO gold LOTR gold silkroad online gold SRO gold silkroad gold buy silkroad gold world of warcraft gold wow gold kaufen buy wow gold wow geld cheap wow gold wow power leveling wow powerleveling age of conan gold age of conan power leveling aoc gold aoc power leveling aoc leveling buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffxi gil GW gold buy Guild Wars gold Guild Wars Gold buy Lineage 2 adena buy Lineage II adena L2 adena Lineage 2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO Gold LOTR Gold silkroad online gold SRO gold Silkroad gold buy silkroad gold

  14.  everquest 2 gold eq2 plat ffxi gil final fantasy xi gil gaia online gold gaia gold guild wars gold gw gold hellgate london palladium cabal alz daoc gold daoc plat buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffix gil GW gold buy Guild Wars gold Guild Wars gold buy Lineage 2 adena buy Lineage II adena Lineage 2 adena L2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO gold LOTR gold silkroad online gold SRO gold silkroad gold buy silkroad gold world of warcraft gold wow gold kaufen buy wow gold wow geld cheap wow gold wow power leveling wow powerleveling age of conan gold age of conan power leveling aoc gold aoc power leveling aoc leveling buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffxi gil GW gold buy Guild Wars gold Guild Wars Gold buy Lineage 2 adena buy Lineage II adena L2 adena Lineage 2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO Gold LOTR Gold silkroad online gold SRO gold Silkroad gold buy silkroad gold

  15.  everquest 2 gold eq2 plat ffxi gil final fantasy xi gil gaia online gold gaia gold guild wars gold gw gold hellgate london palladium cabal alz daoc gold daoc plat buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffix gil GW gold buy Guild Wars gold Guild Wars gold buy Lineage 2 adena buy Lineage II adena Lineage 2 adena L2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO gold LOTR gold silkroad online gold SRO gold silkroad gold buy silkroad gold world of warcraft gold wow gold kaufen buy wow gold wow geld cheap wow gold wow power leveling wow powerleveling age of conan gold age of conan power leveling aoc gold aoc power leveling aoc leveling buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffxi gil GW gold buy Guild Wars gold Guild Wars Gold buy Lineage 2 adena buy Lineage II adena L2 adena Lineage 2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO Gold LOTR Gold silkroad online gold SRO gold Silkroad gold buy silkroad gold

  16.  everquest 2 gold eq2 plat ffxi gil final fantasy xi gil gaia online gold gaia gold guild wars gold gw gold hellgate london palladium cabal alz daoc gold daoc plat buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffix gil GW gold buy Guild Wars gold Guild Wars gold buy Lineage 2 adena buy Lineage II adena Lineage 2 adena L2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO gold LOTR gold silkroad online gold SRO gold silkroad gold buy silkroad gold world of warcraft gold wow gold kaufen buy wow gold wow geld cheap wow gold wow power leveling wow powerleveling age of conan gold age of conan power leveling aoc gold aoc power leveling aoc leveling buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffxi gil GW gold buy Guild Wars gold Guild Wars Gold buy Lineage 2 adena buy Lineage II adena L2 adena Lineage 2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO Gold LOTR Gold silkroad online gold SRO gold Silkroad gold buy silkroad gold

  17.  everquest 2 gold eq2 plat ffxi gil final fantasy xi gil gaia online gold gaia gold guild wars gold gw gold hellgate london palladium cabal alz daoc gold daoc plat buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffix gil GW gold buy Guild Wars gold Guild Wars gold buy Lineage 2 adena buy Lineage II adena Lineage 2 adena L2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO gold LOTR gold silkroad online gold SRO gold silkroad gold buy silkroad gold world of warcraft gold wow gold kaufen buy wow gold wow geld cheap wow gold wow power leveling wow powerleveling age of conan gold age of conan power leveling aoc gold aoc power leveling aoc leveling buy eve isk eve online isk eve isk EverQuest 2 plat EverQuest 2 gold eq2 plat Final Fantasy XI gil ffxi gil GW gold buy Guild Wars gold Guild Wars Gold buy Lineage 2 adena buy Lineage II adena L2 adena Lineage 2 adena cheap lineage 2 adena lineage ii adena Hellgate London Palladium Hellgate online gold Maple Story meso Maple Story Mesos maplestory Mesos Lord of the Rings Online Gold LOTRO Gold LOTR Gold silkroad online gold SRO gold Silkroad gold buy silkroad gold

  18. ffxi gil wow gold maple story mesos maplestory mesos maple story meso wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold

  19. ffxi gil wow gold maple story mesos maplestory mesos maple story meso wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold

  20. wow gold wow gold wow gold kaufen world of warcraft gold wow wow gold buy wow gold cheap wow gold wow gold cheap wow gold cheapest wow gold lord of the rings online gold cheapest wow gold lotro gold wow gold cheap gold wow Cheapest wow gold wow gold cheapest wow gold cheap guild wars gold eve isk cheap world of warcraft gold eq2 platinum Ever quest platinum world of warcraft buy gold lineage 2 adena runescape money wow gold buy runescape gold mp3 players sell wow gold portable mp3 players portable mp3 player buy world of warcraft gold 4GB MP3 PLAYER 2GB MP3 PLAYER buying wow gold mp3 player mp4 player buying gold world of warcraft cheap mp3 players cheap mp3 player buy cheap wow gold buy mp3 player

  21. buy mp3 players wow gold best mp3 player digital mp3 player wow gold kaufen digital audio mp3 player 1GB MP3 PLAYER wow geld 1gb mp3 players mp4 players wow level service mp3 mp4 player 20gb mp3 player wow gold mp3 player 2gb video mp3 player with video wow gold paypal usb mp3 players mp3 player usb wow power leveling flash mp3 player flash mp3 players world of warcraft power leveling mp3 player accessories mp3 player accessory wow powerleveling mp3 player wholesale cell phones cheap world of warcraft power leveling cell phone accessories phones cell world of warcraft powerleveling cheap cell phones Bluetooth Headset cheap world of warcraft powerleveling Bluetooth Headsets ipod wow powerlevel ipods ipod nano wow power level ipod touch apple ipod level wow

  22.  
    ipod shuffle digital cameras wow level digital camera canon digital camera wow leveling dvd player portable dvd players wow leveling service dvd players portable dvd player lord of rings online gold digital camcorder digital camcorders lotro gold mp3 player zubehoer mp3 player guild wars gold 8GB MP3 PLAYER mp3 eve isk mp4 mp3 players buy eve isk mp3 player mp3 players runescape money mp3 player mp4 player runescape gold mp3 mp4 ever quest platinum mp3 mp4 player mp3 players lineage 2 adena mp3 player mp4 player mp3 players mp3 player free online games play war games free online war games online games

 Leave a Reply

(required)

(required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>