Access Denied Error

[Amal Vellappillil]

Following is my setup. I have Dynamic Forms setup in the root of my site collection. I have a sub site called Products inside this site collection in which I have a list that has been Enhanced with DFFS. No one has permission to the root site collection except for me and a colleague of mine. The sub site is not inheriting permissions from the parent site collection and I have given “User A” edit permissions to the sub site. Going through the forum I found that I have to give the user “User A” read permission to SPJS document library in site collection root. So I did that as well. Now when “User A” tries to view the list inside the sub site, he gets an error after the form loads. Its a popup window that says “Access Denied. You do not have the permission to perform this action or access this resource.”

I used the chrome developer tool to do some debugging and found out that ProcessQuery (http://intranet.ltp.org/products/_vti_bin/client.svc/ProcessQuery) is what returning the Error. I have attached the Error window, Request Header and Response Preview screenshots. Please let me know what needs to be done to get rid of this Error.

Thank you,
Amal Vellappillil

Attachments:

1. 

   DFFS_Error_Popup.jpg
   

2. 

   DFFS_Error_ProcessQuery_Headers.jpg
   

3. 

   DFFS_Error_Response_Preview.jpg
   

[AdamP]

Hi Amal
Is there any reason you can’t either;
-give users read access to the root of the site collection
-Set up DFFS directly on the Products sub-site

If you can’t do either of those then on the root site you’ll need to try granting at least some access to all users so they can use services – I’d suggest a minimium of “Use Remote Interfaces – Use SOAP, Web DAV, the Client Object Model or SharePoint Designer interfaces to access the Web site.” That might work, but you may run into other errors (I’ve not tried this scenario myself).

Adam

[Alexander Bautz]

Thanks for helping out here AdamP.

Amal:
If you don’t want to give read access with the rights AdamP suggests, my recommendation would be to set up DFFS in the site itself.

Alexander

[Amal Vellappillil]

Hi,

Is moving the installation from site collection to site as simple as following?
– Create a SPJS document library on the root of the site and copy the DFFS folder there?

Questions?
– Can I still keep the SPJS folder in the site collection root?
– Will I loose all the form configurations/modifications I have done so far? Is there a way to back up the work I have done so far?

Thank you for helping out so far.
– Amal Vellappillil

[Alexander Bautz]

Hi,
You must create a document library named “SPJS” at the root of the site, and move the DFFS folder there. Then you must use the DFFS installer to uninstall and reinstall DFFS to the forms you have used it in as the link to the loader must be updated.

You will not loose any of the configurations as they are already saved in a list in the site, and will automatically be picked up when you reinstall DFFS.

Refer the installation manual here: https://spjsblog.com/dffs/dffs-installation-manual/

Alexander

[Amal Vellappillil]

Hi Alex,

I did as you requested and I see the scripts are being loaded from my subsite instead of site collection root. But I am still getting the same Access Denied error pop up. The user has read rights to the whole site. What needs to be done now? Thank you for helping me so far.

[Alexander Bautz]

Have you ensured the user has the “Use Remote Interfaces – Use SOAP, Web DAV, the Client Object Model or SharePoint Designer interfaces to access the Web site” access right? – you must look under “Site settings” > “Site permissions” > “Permission levels” > “Read”.

Alexander

[Amal Vellappillil]

Hi Alex, I looked for those settings and “Read” has all of the ones you mentioned as allowed.

[Kasey]

I am seeing a similar issue. I have “Full Control” over a sub-site but no access to the parent site collection site. I get the access denied popup in IE and Chrome after the form is done rendering. The other odd thing is the form is not rendering in Chrome. Have very little customization yet but I get “Click for help about adding basic HTML formatting.” in Chrome. The form renders in IE. The issues may be related.

[Alexander Bautz]

Hi,
I tested now with an external user with no access to the root site, and only read access to the sub site.

If I installed DFFS from the root site, it gave access denied as the user cannot read the files, but if I put the DFFS files in a SPJS document library in the same site and used the DFFS installer to remove the existing DFFS version that pointed to the loader in the root site and reinstalled from the installer in the same site it works without any problems.

Please ensure you have the variable “spjs_scripts_in_current_site” in the file “/SPJS/DFFS/loader/DFFS_loader.html” set to true like this:

var spjs_scripts_in_current_site = true;

Alexander

[Alexander Bautz]

Kasey,
The “Click for help about adding basic HTML formatting.” is caused by the RTE editor not having cross browser support. If you are on SP 2010 or 2013 you should change it to “Enhanced Rich text”.

Alexander

[Kasey]

Thanks for the tip on my Chrome issue. I changed the two multi-line text fields from Rich Text to Enhanced Rich Text and that issue was resolved. For the access denied popup I do have my loader file variable set correctly “var spjs_scripts_in_current_site = true;” but still get the popup. To be safe I validated the file, used the installer to uninstall and reinstall and have the same result.

[Alexander Bautz]

Could it be another link somewhere in custom js? do you see which request is failing if you look at the network tab in chrome developer tools? what is missing if you hit “cancel” on the login prompt?

Alexander

[Kasey]

I actually don’t get a login prompt. Just a popup…

sharepoint.xyz.com says:
Access denied. You do not have permissions to perform this action or access this resource.

It appears to be referring to the below which is the subsite URL for which I have Full Control over.
……../_vti_bin/client.svc/ProcessQuery

[Amal Vellappillil]

Hey Alex, is there anything else you recommend? I really need that annoying pop up to go away. Please help.

[AdamP]

Hi Amal

Personally I’d suggest trying a completely new install of DFFS on a new subsite, keeping it as minimal as possible, just a basic list and form to start with.
Once you’ve proven that there are no issues, progressively add more configuration until the problem arises.

Adam

[Amal Vellappillil]

Hi Alex, I see that i am getting a lot of unauthorized request (401 status code) for all of the DFFS files. The user has full control to the SPJS document library and the list. I am very confused at this point.

[Alexander Bautz]

Are you sure the path of the files is to the current site and not to another installation on the root site?

If you have installed DFFS in a subsite you must ensure you have set the location of the files to “same site” by setting this variable to true in the file “/SiteName/SPJS/DFFS/loader/DFFS_loader.html”:

var spjs_scripts_in_current_site = true;

Alexander

[Kasey]

My issue was resolved when I was granted access to the top level site.

[Amal Vellappillil]

Same with me Kasey. I ended up moving the SPJS document library to the site collection and gave view rights to the top level site in the site collection. After that i havent gotten the error message. Whatever we do, it seems like the only solution is to give access to the root site in the site collection to users to not get this error. Not how i wanted to fix the issue, but since there is no other solutions, I have to deal with it for now.

This seems like a bug to me since DFFS allows you to install in just an individual site but also in a site collection.

Thank you for sharing your experiences in this thread. Hope the team will be able to take a look at this issue and get it resolved.

[Alexander Bautz]

Hi,
I’m glad you fond a workaround. In my tests I haven’t been able to find the cause of this issue, but it must be some resources it tries to access that is restricted when the user only has access to the subsite.

Did you use any rules or code that involved checking group membership?

If possible, email me the “blob” from your form (export from Misc tab), and I’ll look at it and see if I can find what resources it tries to access from the root site.

Alexander

[Ross]

Hi Alex,

I know this is an old post but hopefully we can still look into some causes or permanent fixes.

We are experiencing the “Access Denied. You do not have the permission to perform this action or access this resource.”, however the alert doesn’t display on every page load.

The environment is:

• SharePoint 2010
• Windows 10
• Internet Explorer 11
• Document Mode 10
• Charts Version 6
• User Permissions: Site Collection Administrator
• Installed on Top Level Site

I have disabled alert functionality on the page but would rather not override functions if there is a proper fix. It seems like the page still loads correctly after the ProcessQuery returns an error.

Any help would be appreciated.

[Alexander Bautz]

Hi,
What type of authentication are you using in this site, and is it only in the page with the chart you get this error?

Try looking at the Request Header, Response Header and Response Payload to see if you get some clues. In IE you should be able to right click the line in the Network tab in the developer tools and copy this information over in Notepad.

Alexander

[Ross]

Hi Alex,

Thanks for getting back so quickly.

Our authentication is NTLM Class Windows. The error also occurs on the SPJS installer, mostly if we use chrome but sometimes on IE as well.

Screenshots are provided with the request and response. I couldn’t see anything wrong with the requests.

I’m thinking this is environment related issues which are outside my control to solve but if you can shed any light it would help.

Cheers,

Attachments:

1. 

   ProcessQueryError.png
   

2. 

   Installer.png
   

3. 

   Request.png
   

4. 

   Request-Header.png
   

[Alexander Bautz]

I don’t see anything specific in the screenshots. If the error is not showing on all page loads I’m afraid I have no clues. I guess the server somehow fails to process / validate some requests but I don’t really have any experience debugging this kind of things.

You might find some information in the event log on the frontend server, but I’m not sure.

Sorry I cannot be more helpful.

Alexander

[Author]

Posts