Wednesday, August 22, 2012

Updating Organization Profiles using Object Model

If you're updating properties on organization profiles in the 'User Profile Service Application', but your users don't have permissions to modify profiles, you will need to run with elevated privileges. Seems simple enough. Use the SPSecurity class to elevate and instantiate all new objects within the code block.
It's not that simple. You will most likely get an UnauthorizedAccessException 'Attempted to perform an unauthorized operation'. For some reason the OrganizationProfileManager uses the HttpContext class to access the UPSA. To resolve this issue, you need to run with elevated privileges as well as set the HttpContext.Current property to null then restore it after you committed the changes.

If you debug this code, you can see that the SPContext.Current.Site.RootWeb.CurrentUser is the System Account (aka the application pool account). But you have to go the extra step so the OrganizationProfileManager can't use the HttpContext.Current instance.

Remember to add your application pool account to the User Profile Service Application Administrators and give it Manage Profiles permission.
Central Administration > Application Management > Manage service applications > (highlight) User Profile Service Application > click Administrator in the ribbon.

No comments:

Post a Comment