Strange behavoir of RunWithElevatedPrivileges in Console Aplication with FBA

Question

Hi 1. I have a named site collection where FBA is on und i use ActiveDirectoryMembershipProvider. 2. We have a farm administrator domain\administrator. He is not explicitly sitecollection administrator.

I created a sample console application that I run under the domain\administrator account. In the code is something like that:

                    using (SPSite site = new SPSite(serverUrl))
                    {
                        using (SPWeb web = site.OpenWeb())
                        {
                            Console.WriteLine(web.CurrentUser.LoginName);
                            Console.WriteLine(WindowsIdentity.GetCurrent().Name);
                            string userName = "domain\\testuser";
                            SPUser spUser = web.EnsureUser(userName);
                            SPGroup group = web.SiteGroups["GroupName"];
                            group.AddUser(spUser);
                            group.Update();
                        }
                    }

The console output is domain\administrator however I become an AccessDenied exception when I try to add user to the group. However when I run this with RunWithElevetadPrivileges (which according to all posts I read should have no influence in console app) and set AllowUnsafeUpdates = true (the same story) the code goes smoothly through, no exception thrown and the user is added to the group. The interesting thing is that the user that is written to the console output is still domain\administrator.

So my question is: WTF? Is there a better way? Why is this happenning? Has anyone already had this problem? Should I use another membershipprovider?

Small hint: When the FBA is off I become no exceptions.

Answer 1

RunWithElevatedPrivileges runs code with permissions of user that the application pool runs. It can be other than Administrator. Are you sure you get the same result with RunWithElevatedPrivileges?

Anyway, a better, more reliable way of elevating privileges is to pass system users User token in SPSite constructor. Try it.