Methods of running with Elevated Privilges in a MOSS Publishing Site

Question

I am wondering why the two methods listed below do not give the same security trimming.

Expected result: Both methods give full access to all content in the current site collection

Actual result: Security trimming is occuring when using Method #1

• Method #2 works properly for retrieving content from other webs, but Method #1 does not.

• Both methods give access across webs in Anonymous mode, and both work for site admin accounts.

• The difference comes for Hierarchy Managers, Approvers and Editors. Method #1 does not give admin access across webs.

Method #1

using (SystemOperation op = new SystemOperation())
{ 
    //Do an operation that requires retrieving across webs
}

public class SystemOperation : IDisposable
{
    private WindowsImpersonationContext ctx;

    public SystemOperation()
    {
        if (!WindowsIdentity.GetCurrent().IsSystem)
        {
            ctx = WindowsIdentity.Impersonate(System.IntPtr.Zero);
        }
    }

    public void Dispose()
    {
        this.Dispose(true);
        GC.SuppressFinalize(this);
    }

    protected virtual void Dispose(bool all)
    {
        if (ctx != null)
        {
            ctx.Undo();
        }
    }
}

Method #2:

   Microsoft.Sharepoint.SPSecurity.RunWithElevatedPrivileges(delegate()
    {
        //Do an operation that requires retrieving across webs
    });

Answer 1

RunWithElevatedPrivileges provides two separate privledges. First is that it elevates the Windows identity of the user to the AppPool account, the second is that it also elevates the identity to the SharePoint\System account which is a built in security account that provides full control (in a SharePoint sense). The internal SharePoint account is used when you construct your SP Objects (like SPSite).

So basically it will depend on how you build your code and when you instatiate your objects that affect how the privledges work out.