How to implement RunWithElevatedPrivileges in SharePoint Apps (S2S)

This SharePoint tutorial explains, how to use elevate user permission in SharePoint Apps similar to RunWithElevatedPrivilages with Full trust Code. Elevate User Access with App Only Policy

The reason we use RunWithElevatedPrivilages is to execute our code with elevated permission regardless of current login user permission.

By default, SharePoint Apps run in the context of user + app which means the current user and the app both should have sufficient rights to access SharePoint resources. But in some cases we need our app to access SharePoint resources regardless of current user permission, this is where AppOnlyPermssion comes into the picture. In this article, I will let you know how to use it.

Implement RunWithElevatedPrivileges in SharePoint Apps (S2S)

To make an App performing work that the user does not have permission to means we will use the app only policy. To enable the App Only policy in your app, you have to add the “AllowAppOnlyPolicy” attribute to your “AppPermissions” element in the App Manifest:

<AppPermissionRequests AllowAppOnlyPolicy="true" >
</AppPermissionRequests>

This capability is only available to provider-hosted apps. It is not available to SharePoint-hosted apps. In a SharePoint-hosted app, there is Full trust code is not limited by permissions – it can do anything it wants.

S2S (High Trust) – App Only Context

An S2S access token by calling the GetS2SAccessTokenWithWindowsIdentity method of the TokenHelper class. Use the TokenHelper::GetS2SAccessTokenWithWindowsIdentity method, passing a null for the WindowsIdentity parameter.

RunWithElevatedPrivileges in SharePoint Apps

Let’s see how we can actually utilize the App Only policy to elevate user permissions. I have written the following code in the code behind of the TestPage.aspx of S2S Provider Hosted App

Code:

Uri _hostWeb = new Uri(Request.QueryString["SPHostUrl"]);
string appOnlyAccessToken = TokenHelper.GetS2SAccessTokenWithWindowsIdentity(_hostWeb, null);
using (ClientContext clientContext =TokenHelper.GetS2SAccessTokenWithWindowsIdentity(_hostWeb.ToString(),appOnlyAccessToken))
{
List Testlist = clientContext.Web.Lists.GetByTitle("TestList");
ListItemCreationInformation info = new ListItemCreationInformation();
Microsoft.SharePoint.Client.ListItem item = Testlist.AddItem(info);
item["Title"] = "Created S2SApp";
item["Body"] = "Created from S2S" + DateTime.Now.ToLongTimeString();
item.Update();
clientContext.Load(item);
clientContext.ExecuteQuery();
}

Deploy the app and then log on as a user that only has read permission to the list. Execute the code, and a new item is created even though the user does not have permission to create items in the list. The Created By and Modified By fields in the list will reflect that it was the SHAREPOINT\App account that was used to create the item.

Note: As you can see, the ClientContext which is opened with the appOnlyAccessToken will run with the identity of the SHAREPOINT\App account. This is a very good practice to remember even when using RunWithElevatedPreviledges in the Server Object Model.

You may like following SharePoint tutorials:

This tutorial, we learned how to implement RunWithElevatedPrivileges in SharePoint Apps.

Donwload Hub site pdf

Download SharePoint Online Tutorial PDF FREE!

Get update on Webinars, video tutorials, training courses etc.

>