Design question about SPSecurity.RunWithElevatedPriviledges in multi-tiered design

Question

I have a question re: performance and design. Crux of the problem is: do I wrap RunWithElevatedPriviledges around a sequence of methods all requiring its use (but the call is in the wrong layer), do I call it each time in the appropriate later.

I am refactoring code that initially had 2 layers (front-end & database).

I've now split this out into 4 layers

• Front-end (Sharepoint)
• Service-layer
• Data-access-layer
• Database

Now, owing to a prescribed configuration I need to throw RunWithElevatedPriviledges around the sql queries so that the app pool can authenticate against the database (please dont post comments telling me this is a bad idea, I realise this is a terrible idea but it's not my call).

For each data call I will have to be in elevated privileges. For my mind, this should happen in the Service layer. The FE should have no clue about this requirement and neither should the Data Access Layer. However, the service layer is called multiple times to populate a series of dropdowns

i.e.

userlistbox.datasource = MyService.GetUsers(); //Returns an iEnumerable object
citylistbox.datasource = MyService.GetCities(currentRegion); //Returns an iEnumerable object

etc.

The unrefactored version wraps all of these calls with the elevated privileges. My sense is that it will be slightly less performant to push this into the service layer but that it's a better design.

Thoughts? And please, no bashing the constraints I can't do anything about.

Answer 1

Better in the Service layer than in the Front End. Maybe you could pass the SPSecurity.CodeToRunElevated Delegate?

http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.codetorunelevated.aspx