SharePoint 2013 Bug: Access Denied Error While Activating “Following Content” Feature

Vignesh Ganesan
8y
4.2k
0
2

Article

Alright ... This post is regarding a bug with the “SharePoint site follow feature" that we recently happened to encounter in our environment. This specific bug which I’m going to discuss in this article has already been acknowledged by Microsoft as a bug which was later fixed in Office 365 (SharePoint Online). I’m not sure if this is a known issue but if this is something new to you, please try to go through this article to have a clear understanding about this issue.

So before we can start discussing about bug, how about a small introduction on the “follow” feature and what it does and how to activate it.

Activating this feature:

Go to site settings - Manage site features - Active following content feature.
Doing this will turn on the follow feature on the site and will display the “follow” button on the top right corner of your site.

What happens when I follow a site and what’s the permission level needed to follow a site?

You at least need “Read" permissions on the site you’re trying to follow. Following a site will bring the conversations being discussed on the site’s feed to your “My site” Newsfeed section. Make sure you have the “Site Feed" feature turned on to add the “Site Feed” web part to the main site. This is where the conversations take place.

feed

What else can be followed?

The below mentioned four things can be followed in SharePoint.

Site:

This will bring the conversations happening on the site’s feed which you’re following to your “My site” Newsfeed section.
People:

Following a person will start showing the things they do, they say, and the things that happen to them (for example, job title changes).
Documents:

Following a document will display any changes made to that document in your Newsfeed. This way you can keep track of all the changes made to a document you're currently working on and following:
#Tags:

Following a #Tag will bring all the conversations that include that #Tag to your Newsfeed even though you don’t have any idea about the person who is using that #Tag in a conversation. Also please note that a #Tag should always be in a single word only. It can’t be in two words.

In addition to this you have a special section called “Trending Tags” in your “My site” which displays the heavily used Top 5 #tags in your farm. This web part works based on search content crawling. I have written an article about this on my blog site already, please go through that article by clicking here.

Now, since we discussed about the “follow” feature and its uses, let’s jump into the Bug that I pointed out before in this article…

Bug in the site “follow” feature:

When you try to go to the site settings and activate the “Following content” feature you will end up getting an “Access denied error.” Now this is not the case all the time, but during some special scenarios where only the person who created the site would be able to activate this feature.

content

message
I confirmed that I’m the site collection admin in the site where I’m trying to activate this feature and still it won’t allow me to do it. I tried removing myself from the SCA group, removed my account from ‘People & Groups” section and added myself back again and still it didn’t allow me to activate this feature. I tried couple of times and also asked the other SCA’s of the site to activate this feature and still it gave the same error …Weird, isn’t it?

So after spending quite some time in trying to activate this feature we started to dig into the uls logs by turning on verbose logging and this is what we found,

SPRequest.GetFileAndFolderProperties: UserPrincipalName = i: 0).w | s - 1 - 5 - 21 - 962155459 - 1177681987 - 1237804090 - 74654, AppPrincipalName = , bstrUrl = http: //<my site>/personal/<user account> ,bstrStartUrl=Social/Private/FollowedSites,ListDocsFlags=24584 ,bThrowException=False a0fa9d9c-f590-6094-c775-fb7648d76852
System.UnauthorizedAccessException: < nativehr > 0x80070005 < /nativehr><nativestack></nativestack > Access is denied., StackTrace: at Microsoft.SharePoint.SPWeb.GetFileOrFolderProperties(String strUrl, ListDocsFlags listDocsFlags, Boolean throwException, SPBasePermissions & permMask) at Microsoft.SharePoint.SPFolder.PropertiesCore(Boolean throwException) at Microsoft.SharePoint.SPFolder.get_Exists() at Microsoft.Office.Server.UserProfiles.SPSocialDataStore.EnsureNamespaceExists(String ns, String scopeName, Boolean secured) at Microsoft.Office.Server.UserProfiles.SPSocialDataStore.WriteFollowedItem(FollowedItem item, FollowedItemData data) at Microsoft.Office.Server.UserProfiles.SPSocialDataStore.Follow(FollowedItem item, FollowedItemData data, Boolean checkLimit) at Mic...a0fa9d9c - f590 - 6094 - c775 - fb7648d76852
...rosoft.Office.Server.UserProfiles.FollowedContent.FollowItem(FollowedItem item, Boolean isInternal) at Microsoft.Office.Server.UserProfiles.FollowedContent.Follow(Uri url, FollowedItemData data) atMicrosoft.SharePoint.Portal.ContentFollowingFeatureReceiver.AutoFollowWeb(SPWeb web) at Microsoft.SharePoint.Portal.ContentFollowingFeatureReceiver.FeatureActivated(SPFeatureReceiverProperties properties) at Microsoft.SharePoint.SPFeature.DoActivationCallout(Boolean fActivate, Boolean fForce) at Microsoft.SharePoint.SPFeature.Activate(SPSite siteParent, SPWeb webParent, SPFeaturePropertyCollection props, SPFeatureActivateFlags activateFlags, Boolean fForce)
System.UnauthorizedAccessException: Access denied., StackTrace:
at Microsoft.SharePoint.SPWeb.GetFileOrFolderProperties(String strUrl, ListDocsFlags listDocsFlags, Boolean throwException, SPBasePermissions & permMask)
at Microsoft.SharePoint.SPFolder.PropertiesCore(Boolean throwException)
at Microsoft.SharePoint.SPFolder.get_Exists()
at Microsoft.Office.Server.UserProfiles.SPSocialDataStore.EnsureNamespaceExists(String ns, String scopeName, Boolean secured)
at Microsoft.Office.Server.UserProfiles.SPSocialDataStore.WriteFollowedItem(FollowedItem item, FollowedItemData data)
at Microsoft.Office.Server.UserProfiles.SPSocialDataStore.Follow(FollowedItem item, FollowedItemData data, Boolean checkLimit)
at Microsoft.Office.Server.UserProfiles.FollowedContent.FollowItem(FollowedItem item, Boolean isInternal)
at Microsoft.Office.Server.UserProfiles.FollowedContent.Follow(Uri url, FollowedItemData data)
at Microsoft.SharePoint.Portal.ContentFollowingFeatureReceiver.AutoFollowWeb(SPWeb web)
at Microsoft.SharePoint.Portal.ContentFollowingFeatureReceiver.FeatureActivated(SPFeatureReceiverProperties properties)
at Microsoft.SharePoint.SPFeature.DoActivationCallout(Boolean fActivate, Boolean fForce)
at Microsoft.SharePoint.SPFeature.Activate(SPSite siteParent, SPWeb webParent, SPFeaturePropertyCollection props, SPFeatureActivateFlags activateFlags, Boolean fForce)
at Microsoft.SharePoint.SPFeatureCollection.AddInternal(SPFeatureDefinition featdef, Version version, SPFeaturePropertyCollection properties, SPFeatureActivateFlags activateFlags, Boolean force, Boolean fMarkOnly)
at Microsoft.SharePoint.SPFeatureCollection.AddInternalWithName(Guid featureId, Int32 compatibilityLevel, String featureName, Version version, SPFeaturePropertyCollection properties, SPFeatureActivateFlags activateFlags, Boolean force, Boolean fMarkOnly, Boolean fIgnoreMissing, SPFeatureDefinitionScope featdefScope)
at Microsoft.SharePoint.WebControls.FeatureActivator.ActivateFeature(Guid featid, Int32 compatibilityLevel, SPFeatureDefinitionScope featdefScope)
at Microsoft.SharePoint.WebControls.FeatureActivatorItem.ToggleFeatureActivation()
at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)
at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
at System.Web.UI.Page.ProcessRequest()
at System.Web.UI.Page.ProcessRequest(HttpContext context)
at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean & completedSynchronously)
at System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception error)
at System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb)
at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context)
at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus & notificationStatus)
at System.Web.Hosting.UnsafeIISMethods.MgdIndicateCompletion(IntPtr pHandler, RequestNotificationStatus & notificationStatus)
at System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)
at System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(IntPtr rootedObjectsPointer, IntPtr nativeRequestContext, IntPtr moduleData, Int32 flags)

So as you can see in the uls logs it’s throwing an Unauthorized access exception error while you’re trying to activate the feature and it points to a different user’s My site social list and not to the current user’s My site social list who’s trying to activate the feature.

So now when we asked the user who was shown as exception to activate the feature it worked perfectly fine, the user was able to activate it. So we started researching about this on the internet and after loads of effort we were finally able to find a blog article where the author clearly described what happens in the background when you’re trying to activate this feature on a site.

So this is what exactly happens when you’re trying to activate a site feature and mentioned below (screenshot below) is the code for the site feature activate method.

code

It makes a call to the AutoFollowWeb() and mentioned below is the code for that…

code

Now, please notice the last few lines in the above code….It’s looking for the author (person who created this site) of the site to activate the feature and not the current logged on user,

UserProfile userProfile = userProfileManager.GetUserProfile(web.Author.LoginName);
SPUserToken userToken = web.Author.UserToken;
FollowedContent followedContent = new FollowedContent(userProfile, context, userToken)

So this means only the author (the person who created this site) would be able to activate this feature and not others even though they are added as SCA’s.

Few Gotchas:

Only the person who created the site would be able to activate this feature and not others, even though we are present in the SCA group.
The “site follow” feature will by default look only for the author of the site and not the person who’s trying to activate this feature.
Once the author activates this feature then other users would be able to click on the “follow” button and follow the site.

I bet now you will have had a clear understanding about this issue. If you’re facing this issue in your environment then I would suggest to open a support case with Microsoft and work with them on this issue. Also I guess if you try to add yourself as a site collection admin to the author’s personal site collection then I believe you will be able to activate this feature on all the sites which was created by that user (However, I haven’t tried that option yet) .

Thanks for reading this post.