SecurityException when accessing SPFarm PropertyBag from WCF service hosted in SharePoint

Question

I've hosted an WCF service in SharePoint 2010 (basicHttpBinding) using this tutorial. The assembly is deployed to the GAC and contains the WCF service and a timerjob. Both call the same method. The timerjob works successful.

But when I call the method of the WCF service, I get an exception, that it can't write a property in the SPFarm PropertyBag.

System.Security.SecurityException: Access denied.
   at Microsoft.SharePoint.Administration.SPPersistedObject.BaseUpdate()
   at Microsoft.SharePoint.Administration.SPFarm.Update()
   at MyCompany.MyProduct.Business.Config.SetPropertyValue(IPropertyBag propertyBag, String propertyName, String value)
The Zone of the assembly that failed was:
MyComputer

I tried to call the method using the Farm Administrator account and tried to use SPSecurity.RunWithElevatedPrivileges, but to no success.

I checked WindowsIdentity.GetCurrent() inside and outside the elevated privileges block, outside it's the callers user and inside it's the user of the WebApplications AppPool.

So the AppPool user is correctly impersonated, but SharePoint 2010 "disallows modification ... to all objects inheriting from SPPersistedObject in the Microsoft.SharePoint.Administration namespace ... from content web applications"

The article says, there is a switch SPWebService.ContentService.RemoteAdministratorAccessDenied (namespace Microsoft.SharePoint.Administration) to get rid of this behaviour, but I can't rely on administrators to use this to get my solution running.

So I'm still without a solution

Answer 1

The security credentials from the calling process are probably copied. You can configure WCF whether or not to do this.

See http://msdn.microsoft.com/en-us/library/ms731925.aspx for more information.

Answer 2

I found a hack to work around the problem. I will not use it, because it is really dirty, but maybe somebody needs it, so:

1. Don't call the WCF Service by a normal web application URL. Use the URL of the Central Administration (e.g. http://myserver:9999/_vti_bin/project/myservice.svc)
2. Run the part where you change the Farm Properties with elevated privileges (SPSecurity.RunWithElevatedPrivileges).
3. Before the elevated part (now it gets really dirty) set System.Web.HttpContext.Current.Items["FormDigestValidated"] = true;

As I said, not a nice one, but working ...