SecurityException using SPWebConfigModification

Question

I'm getting a SecurityException, "Access Denied" when trying to make a web.config modification programmatically.

Code closely follows this example:

    public override void FeatureActivated(SPFeatureReceiverProperties properties)
    {
        // create modification
        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            SPWebConfigModification m = new SPWebConfigModification();
            m.Path = "configuration/SharePoint/SafeControls";
            m.Name = string.Format(CultureInfo.InvariantCulture, "SafeControl[@Assembly='{0}'][@Namespace='{1}'][@TypeName='*'][@Safe='True']", ADSWebPart.GetAssemblyFullName(), ADSWebPart.GetNamespace());
            m.Sequence = 0;
            m.Owner = SPContext.Current.Web.CurrentUser.Name;
            m.Type = SPWebConfigModification.SPWebConfigModificationType.EnsureChildNode;
            m.Value = string.Format(CultureInfo.InvariantCulture, "<SafeControl Assembly='{0}' Namespace='{1}' TypeName='*' Safe='True' />", ADSWebPart.GetAssemblyFullName(), ADSWebPart.GetNamespace());

            // apply modification
            SPWebService service = SPWebService.ContentService;
            service.WebConfigModifications.Add(m);
            service.Update();
            service.ApplyWebConfigModifications();
        });
    }

(I started with no call to RunWithElevatedPrivileges(), got same exception, then continued enclosing more and more code up to enclosing all body of FeatureActivated().)

Ideas welcome, thanks.

Answer 1

Out of sheer curiosity, is the web.config set to read only? Have you checked the permissions on the filesystem for the web directory in inetpub?

Also, is this being activated on the Web Application level or further down?

Answer 2

Hi Ariel

I'm not answering your question as asked, but why are you using a Feature receiver to add SafeControl Entries?

The "Right" way to add SafeControl Entries is to embed these inside <SafeControls> inside the corresponding <Assembly> in manifest.xml of your Solution like this:

<Assembly Location="MyLib.dll" DeploymentTarget="WebApplication">
  <SafeControls>
    <SafeControl Assembly="MyLib, Version=1.0.0.0, Culture=neutral, PublicKeyToken=4489c7aa5341e32c" Namespace="MyNs" TypeName="*" Safe="True" />
  </SafeControls>
</Assembly>

Answer 3

Instead of using SPContext.Current.Web.CurrentUser.Name;

Try following the instructions here to impersonate the SystemAccount: http://blackninjasoftware.com/2009/04/09/how-to-programmatically-impersonate-users-in-sharepoint/

Answer 4

Another question, are you activating the feature from a Forms Based Authentication site? You can have issues because the site collection administrator is from the authentication provider path, and not AD. The Web.Config file security is based on the AD account, so you have no ability to update the web.config without doing something bad, like giving Everyone access to web.config.

Here is an earlier question I posted on the topic.

http://stackoverflow.com/questions/868393/modifying-sharepoint-app-web-config-file-with-forms-based-authentication