Best Practices for Elevated Privilege in SharePoint

Elevated Privilege can be used to bypass or work with security, and can be performed either through SPSecurity or through impersonation techniques involving the SPUserToken and the SPSite class. It’s one of the most misunderstood aspects of the SharePoint API, but in general you should always prefer impersonation using the SPSite class and SPUserToken objects.

While I’ve been ranting about SPSecurity over the last few days, it can be useful for running code under the context of the application pool for code that access network or file resources, or for MOSS code that does not support impersonation through the SPSite object. Without further introduction, here’s my list of best practices for elevated privilege code in SharePoint that will help you create more reliable applications for the enterprise.

  • Avoid using SPSecurity.RunwithElevatedPrivilege to access the SharePoint object model. Instead, use the SPUserToken to impersonate with SPSite.
  • If you do use SPSecurity.RunwithElevatedPrivilege, dispose of all objects in the delegate. Do not pass SharePoint objects out of the RunwithElevatedPrivilege  method.
  • Only use SPSecurity.RunwithElevatedPrivilege to make network calls under the application pool identity. Don’t use it for elevation of privilege of SharePoint objects.
  • Always use the SPSite constructor with an SPUserToken to create an elevated privilege security context in SharePoint. To impersonate the system, use the SystemAccount.UserToken property of the current SPSite context, such as:
    var site = new SPSite(SPContext.Current.Site.ID,  SPContext.Current.Site.SystemAccount.UserToken);
  • Avoid passing SharePoint objects between different security contexts (SPSite instances), with the exception of the SPUserToken used in the SPSite ctor. An SPUser object created from SPSite A cannot (reliably) be passed to SPSite B. This can be the source of obscure bugs in production that are difficult to reproduce in development. For example, an SPUser reference created from SPContext.Current.Site cannot reliably be used in an elevated site context, as the user reference may take on a different meaning in the alternate context.
  • Never use elevated privilege to bypass security– always use it to work with security.
  • Restrict what assemblies can use elevated privilege by running in minimal trust, avoiding the GAC, and auditing any CAS policies deployed with vendor solutions.
This entry was posted in SharePoint. Bookmark the permalink.

7 Responses to Best Practices for Elevated Privilege in SharePoint

  1. Alonso Robles says:

    Thanks for the list of best practices it\’s a great reference. I hope you don\’t mind I have reposted it on my blog.

  2. Unknown says:

    We provide all Wow gold services. You can buy wOW Gold, Cheap woW gold here. We provide Cheap wOW Gold to each loyal and reliable customer.

  3. Unknown says:

    jap9527 cl512ong wow gold wow gold wow gold wow gold wow gold wow gold 股票软件 股票软件 黑马股推荐 黑马股推荐 大智慧 大智慧 全教振 全教振 全教振 专业洗鞋店 日本签证 澳洲签证 移民德国 新加坡签证 擦鞋 SKF轴承 SKF轴承 NSK轴承 NSK轴承 深圳网页制作 深圳网页制作 中高年 転職 中高年 転職 賃貸 賃貸 不動産 不動産 深圳网页设计 深圳网页设计 FAG轴承 FAG轴承 深圳网站建设 深圳网站建设 wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold wow gold

  4. Unknown says:

    外国為替 出会い系   アクサ  アクサダイレクト  為替 有料老人ホーム三井ダイレクト  東京 土地 結婚式 行政書士 看護 ウェディング ウェディング 結婚式 現金化 派遣会社 不動産 クレジットカード 現金化
    医院開業  人材派遣 ドロップシッピング 副業 引越 沖縄旅行  パイプカット  ローン  

  5. Unknown says:

    wow gold wow gold wow gold kaufen world of warcraft gold wow wow gold buy wow gold cheap wow gold wow gold cheap wow gold cheapest wow gold lord of the rings online gold cheapest wow gold lotro gold wow gold cheap gold wow Cheapest wow gold wow gold cheapest wow gold cheap guild wars gold eve isk cheap world of warcraft gold eq2 platinum Ever quest platinum world of warcraft buy gold lineage 2 adena runescape money wow gold buy runescape gold mp3 players sell wow gold portable mp3 players portable mp3 player buy world of warcraft gold 4GB MP3 PLAYER 2GB MP3 PLAYER buying wow gold mp3 player mp4 player buying gold world of warcraft cheap mp3 players cheap mp3 player buy cheap wow gold buy mp3 player

  6. Unknown says:

    buy mp3 players wow gold best mp3 player digital mp3 player wow gold kaufen digital audio mp3 player 1GB MP3 PLAYER wow geld 1gb mp3 players mp4 players wow level service mp3 mp4 player 20gb mp3 player wow gold mp3 player 2gb video mp3 player with video wow gold paypal usb mp3 players mp3 player usb wow power leveling flash mp3 player flash mp3 players world of warcraft power leveling mp3 player accessories mp3 player accessory wow powerleveling mp3 player wholesale cell phones cheap world of warcraft power leveling cell phone accessories phones cell world of warcraft powerleveling cheap cell phones Bluetooth Headset cheap world of warcraft powerleveling Bluetooth Headsets ipod wow powerlevel ipods ipod nano wow power level ipod touch apple ipod level wow

  7. Unknown says:

     
    ipod shuffle digital cameras wow level digital camera canon digital camera wow leveling dvd player portable dvd players wow leveling service dvd players portable dvd player lord of rings online gold digital camcorder digital camcorders lotro gold mp3 player zubehoer mp3 player guild wars gold 8GB MP3 PLAYER mp3 eve isk mp4 mp3 players buy eve isk mp3 player mp3 players runescape money mp3 player mp4 player runescape gold mp3 mp4 ever quest platinum mp3 mp4 player mp3 players lineage 2 adena mp3 player mp4 player mp3 players mp3 player free online games play war games free online war games online games

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s