A very weird and hard to pinpoint SharePoint error has haunted me these last days.
The Symptoms
You have a SharePoint site collection that uses Publishing features. Suddenly, the users can’t access your site. All user accounts, including site collection administrators, get the dreaded "Access Denied" error. In my case, it was SharePoint 2010 with a custom site template with publishing features included in it.
The SharePoint log files mention this:
|
1 |
Failed to create a custom control 'PublishingSiteActionsMenuCustomizer', feature 'Publishing' (id:22a9ef51-737b-4ff2-9346-694633fe4416) using attributes (ControlSrc='', ControlAssembly='Microsoft.SharePoint.Publishing, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c', ControlClass='Microsoft.SharePoint.Publishing.WebControls.PublishingSiteActionsMenuCustomizer': <br /> |
The Cause
It is really strange that SharePoint can’t load it’s own components. But, the real cause it that the web application that a culprit site collection is running on is missing its "superuser" settings. The SuperUsers are the users configured for Publishing infrastructure to read and write publishing cache. It seems that if the users are not correctly configured, the publishing infrastructure fails badly and SharePoint interprets it as "Access Denied".
Two blog posts were of great help: Khashish Sukhija and Nico Marten’s. Thank you guys! I checked the web application properties from PowerShell and the super user entries were empty for the web application that was behaving strangely.
The Fix
Execute the script found on Nico’s post (reproduced here for convenience, all credit is his) and IISRESET.
|
1 |
<span style="color: #008000"># This script will add the superuser and superreader account to the Policy for web app </span><br /><span style="color: #008000"># and also set the web application properties so that the users will be used for caching </span><br /><span style="color: #008000"># The script is designed in a way that you do NOT have to adjust the script before useAdd-PSSnapin Microsoft.SharePoint.PowerShell</span><br /><span style="color: #008000"># Function </span><br /><span style="color: #0000ff">function</span> addUsersToPolicyAndProperties <br />{ <br />$webapps = get-spwebapplication <br />$superuser = Read-Host <span style="color: #006080">"Fill in the SuperUser account: <Domain><Username>"</span> <br />$superreader = Read-Host <span style="color: #006080">"Fill in the SuperReader: <Domain><Username>"</span><br /><span style="color: #008000">#foreach statement that will loop through all web applications </span><br /><span style="color: #0000ff">foreach</span>($webapp <span style="color: #0000ff">in</span> $webapps) <br />{ <br />try { <br />$SUpolicy = $webapp.Policies.Add($superuser,$superuser) <br />$SUpolicy.PolicyRoleBindings.Add($webapp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullControl))<br />$SRpolicy = $webapp.Policies.Add($superreader,$superreader) <br />$SRpolicy.PolicyRoleBindings.Add($webapp.PolicyRoles.GetSpecialRole([Microsoft.SharePoint.Administration.SPPolicyRoleType]::FullRead)) <br />$webapp.Properties[<span style="color: #006080">"portalsuperuseraccount"</span>] = [string]$superuser <br />$webapp.Properties[<span style="color: #006080">"portalsuperreaderaccount"</span>] = [string]$superreader<br />$webapp.Update()<br />Write-Host <span style="color: #006080">"$webapp.displayname has been configured correctly"</span> <br />} <br />catch <br />{ <br />Write-Host <span style="color: #006080">"Error adding the users for $webapp.displayname"</span> -fore red <br />} <br />} <br />Write-Host <span style="color: #006080">"All web applications are done, press any key to exit"</span> -fore green <br />$x = $host.UI.RawUI.ReadKey(<span style="color: #006080">"NoEcho,IncludeKeyDown"</span>) <br />} <br /><span style="color: #008000">#Call function</span><br />addUsersToPolicyAndProperties |
