{"id":1747,"date":"2014-11-20T13:29:31","date_gmt":"2014-11-20T13:29:31","guid":{"rendered":"http:\/\/www.stuartroberts.net\/?p=1747"},"modified":"2014-11-20T13:29:31","modified_gmt":"2014-11-20T13:29:31","slug":"workflow-app-permissions","status":"publish","type":"post","link":"https:\/\/www.stuartroberts.net\/index.php\/2014\/11\/20\/workflow-app-permissions\/","title":{"rendered":"Workflow App Permissions"},"content":{"rendered":"<p>With the new 2013 workflows there are a few scenarios that can cause issues which may not be obvious to those coming from 2010.  One such scenario is configuring list items to have <em>Create and Edit access<\/em> set to <em>Create items and edit items that were created by the user<\/em> and have a user who did not create the item initiate a 2013 workflow.  By default, this will result in the workflow failing due to unauthorised access exceptions.<\/p>\n<p>Lets walk through the scenario in more detail.<\/p>\n<p>Start with creating a new custom list and then in SharePoint Designer, publish a simple List workflow to it.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Publish-SPD-Workflow.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Publish-SPD-Workflow.png\" alt=\"Publish SPD Workflow\" width=\"833\" height=\"190\" class=\"aligncenter size-full wp-image-1750\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Publish-SPD-Workflow.png 833w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Publish-SPD-Workflow-300x68.png 300w\" sizes=\"(max-width: 833px) 100vw, 833px\" \/><\/a><\/p>\n<p>As you can see, a very simple workflow \ud83d\ude42<\/p>\n<p>Configure the list to allow users to only edit items that they created.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/List-Permissions.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/List-Permissions.png\" alt=\"List Permissions\" width=\"622\" height=\"236\" class=\"aligncenter size-full wp-image-1751\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/List-Permissions.png 622w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/List-Permissions-300x113.png 300w\" sizes=\"(max-width: 622px) 100vw, 622px\" \/><\/a><br \/>\n<!--more--><br \/>\nFor testing this scenario, configure the workflow to <em>Allow this workflow to be manually started by an authenticated user with Edit Item permissions<\/em><\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-Start-Settings.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-Start-Settings.png\" alt=\"Workflow Start Settings\" width=\"809\" height=\"102\" class=\"aligncenter size-full wp-image-1752\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-Start-Settings.png 809w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-Start-Settings-300x37.png 300w\" sizes=\"(max-width: 809px) 100vw, 809px\" \/><\/a><\/p>\n<p>Create a new item and initiate the workflow.  Assuming no errors in the workflow itself and it completes with no user interaction, i.e. no tasks, etc. the workflow will successfully run and finish.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Workflow.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Workflow.png\" alt=\"Successful Workflow\" width=\"1122\" height=\"476\" class=\"aligncenter size-full wp-image-1753\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Workflow.png 1122w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Workflow-300x127.png 300w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Workflow-1024x434.png 1024w\" sizes=\"(max-width: 1122px) 100vw, 1122px\" \/><\/a><\/p>\n<p>As a different user, initiate the same workflow against the same list item.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Failed-Workflow.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Failed-Workflow.png\" alt=\"Failed Workflow\" width=\"648\" height=\"402\" class=\"aligncenter size-full wp-image-1754\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Failed-Workflow.png 648w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Failed-Workflow-300x186.png 300w\" sizes=\"(max-width: 648px) 100vw, 648px\" \/><\/a><\/p>\n<p>This time, with the item being created by me and not SPDev Member, the workflow fails and is cancelled.  Looking through the ULS logs, there are a few items that will help to indicate why.  These include:<\/p>\n<ul>\n<li>SPRequest.AddOrUpdateItem: UserPrincipalName=<\/li>\n<li>Exception occured in scope Microsoft.SharePoint.SPListItem.UpdateWithFieldValues. Exception=System.UnauthorizedAccessException:<\/li>\n<li>Original error: System.UnauthorizedAccessException: <nativehr>0x80070005<\/nativehr><nativestack><\/nativestack><\/li>\n<\/ul>\n<p>All point to an unauthorised exception adding or updating the item, which makes sense considering we set the edit settings to only allow the user who created the item to edit it.  To resolve this we need to tell SharePoint to run the workflow with elevated permissions.  This is done by doing the following:<\/p>\n<p>Activate the web scoped feature <em>Workflows can use app permissions<\/em>.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Web-Feature.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Web-Feature.png\" alt=\"Web Feature\" width=\"787\" height=\"107\" class=\"aligncenter size-full wp-image-1755\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Web-Feature.png 787w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Web-Feature-300x40.png 300w\" sizes=\"(max-width: 787px) 100vw, 787px\" \/><\/a><\/p>\n<p>From the Site Settings page, click <em>Site App Permissions<\/em>.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Site-App-Permissions.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Site-App-Permissions.png\" alt=\"Site App Permissions\" width=\"257\" height=\"225\" class=\"aligncenter size-full wp-image-1756\" \/><\/a><\/p>\n<p>Find the app titled <em>Workflow<\/em> and copy the first Guid in the <em>App Identifier<\/em> column, highlighted in the following screenshot.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-app-permission.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-app-permission.png\" alt=\"Workflow app permission\" width=\"798\" height=\"123\" class=\"aligncenter size-full wp-image-1757\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-app-permission.png 798w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Workflow-app-permission-300x46.png 300w\" sizes=\"(max-width: 798px) 100vw, 798px\" \/><\/a><\/p>\n<p>Basically everything between the first pipe character <em>|<\/em> and the first ampersand <em>@<\/em><\/p>\n<p>Navigate to <em>~\/_layouts\/15\/appinv.aspx<\/em>, there&#8217;s no link to this page so you&#8217;ll need to manually enter it into the address bar.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/appinv-page.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/appinv-page.png\" alt=\"appinv page\" width=\"757\" height=\"489\" class=\"aligncenter size-full wp-image-1759\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/appinv-page.png 757w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/appinv-page-300x193.png 300w\" sizes=\"(max-width: 757px) 100vw, 757px\" \/><\/a><\/p>\n<p>Paste the Guid you copied earlier into the <App Id><\/em> text box and click the <em>Lookup<\/em> button.  This will automatically populate the Title, App Domain and Redirect URL text boxes.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/App-Id-Lookup.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/App-Id-Lookup.png\" alt=\"App Id Lookup\" width=\"596\" height=\"336\" class=\"aligncenter size-full wp-image-1760\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/App-Id-Lookup.png 596w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/App-Id-Lookup-300x169.png 300w\" sizes=\"(max-width: 596px) 100vw, 596px\" \/><\/a><\/p>\n<p>Next, paste the following XML into the <em>Permission Request XML<\/em> text box and click the <em>Create<\/em> button.<\/p>\n<pre lang=\"xml\">\r\n<AppPermissionRequests>\r\n  <AppPermissionRequest Scope=\"http:\/\/sharepoint\/content\/sitecollection\/web\" Right=\"FullControl\" \/>\r\n<\/AppPermissionRequests>\r\n<\/pre>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Permission-Request-XML.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Permission-Request-XML.png\" alt=\"Permission Request XML\" width=\"599\" height=\"440\" class=\"aligncenter size-full wp-image-1761\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Permission-Request-XML.png 599w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Permission-Request-XML-300x220.png 300w\" sizes=\"(max-width: 599px) 100vw, 599px\" \/><\/a><\/p>\n<p>Lastly, confirm that you want to trust all workflows for the current site by clicking the <em>Trust It<\/em> button.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Trust-Workflow.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Trust-Workflow.png\" alt=\"Trust Workflow\" width=\"554\" height=\"270\" class=\"aligncenter size-full wp-image-1762\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Trust-Workflow.png 554w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Trust-Workflow-300x146.png 300w\" sizes=\"(max-width: 554px) 100vw, 554px\" \/><\/a><\/p>\n<p>Now try initiating the same workflow that failed previously, running as a user who did not create the item.  This time the workflow will run and complete without error.<\/p>\n<p><a href=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Elevated-Workflow.png\"><img decoding=\"async\" loading=\"lazy\" src=\"http:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Elevated-Workflow.png\" alt=\"Successful Elevated Workflow\" width=\"1205\" height=\"185\" class=\"aligncenter size-full wp-image-1763\" srcset=\"https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Elevated-Workflow.png 1205w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Elevated-Workflow-300x46.png 300w, https:\/\/www.stuartroberts.net\/wp-content\/uploads\/2014\/11\/Successful-Elevated-Workflow-1024x157.png 1024w\" sizes=\"(max-width: 1205px) 100vw, 1205px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>With the new 2013 workflows there are a few scenarios that can cause issues which may not be obvious to those coming from 2010. One such scenario is configuring list items to have Create and Edit access set to Create &hellip; <a href=\"https:\/\/www.stuartroberts.net\/index.php\/2014\/11\/20\/workflow-app-permissions\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"jetpack_post_was_ever_published":false,"jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":[]},"categories":[50,3,82],"tags":[81,11,30],"jetpack_publicize_connections":[],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/plx2I-sb","_links":{"self":[{"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/posts\/1747"}],"collection":[{"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/comments?post=1747"}],"version-history":[{"count":6,"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/posts\/1747\/revisions"}],"predecessor-version":[{"id":1766,"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/posts\/1747\/revisions\/1766"}],"wp:attachment":[{"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/media?parent=1747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/categories?post=1747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.stuartroberts.net\/index.php\/wp-json\/wp\/v2\/tags?post=1747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}