Skip to main content

Notifications

Announcements

No record found.

Microsoft Dynamics CRM (Archived)

Execute "as the workflow owner" and problem with impersonation

Posted on by

I did a search of this forum and came across Scott Durow's great article on this topic here: http://www.develop1.net/public/post/user-impersonation-in-plugins-workflow-and-dialogs.aspx.

I fear my situation is a result of the Parent on demand workflow controlling the impersonation of a called child workflow even though the child is configured to run "as the workflow owner."  Here is my scenario:

 I have an on demand workflow triggered "on entry" of a business process flow stage which takes money out of my custom general ledger entity record.  We'll call it "Decrement Funds."

<sidenote>  I consistently name my workflows so I know how they are triggered.  For example, in this case, 'EntityA-D-DecrementFunds" tells me it runs on the EntityA entity and is on "D"emand. </sidenote>

EntityName-D-DecrementFunds calls a child workflow run on child records (via AG Utilities One to Many plug in).  That child workflow is supposed to take money out of the general ledger.  The user running the workflow cannot have direct edit to this entity, so I set all fields on it for field security, run the child as "run as workflow owner." and assign it to a service account with permissions to update that entity via field security profile.

No matter what I do, this results in a permissions error saying the user running the workflow does not have permission to update the general ledger.

I'm perplexed how to get around this.  Some options I've considered:

  1. Trigger the child workflow from the change of a field rather than the change of a stage so it doesn't have to be "on demand."  Woudl that work?  Is this purely about "on demand" vs. on field change?  This will be problematic, though, because I control all my customization by stage change.  
  2. Maybe if the child workflow ran as a background process?  Would it matter?

HELP!

*This post is locked for comments

  • TomSmelser Profile Picture
    TomSmelser 1,570 on at
    RE: Execute "as the workflow owner" and problem with impersonation

    Debra,

    Sounds like option 1 may be best choice. Or another option, to create a glchange entity to create a change record, then trigger off of the oncreate. You would have a custom change history as well. You could even flag these as complete after the workflow runs. A bit of work though.

    Good Luck!

    I found this similar issue. Sounds like others have had this as well.  community.dynamics.com/.../135682

  • Kenneth Leong Profile Picture
    Kenneth Leong 360 on at
    RE: Execute "as the workflow owner" and problem with impersonation

    option 1 is an option, but as you said, it's problematic.

    Another option is you could code an assembly to impersonate as the system user to do it.

  • Loic Orue Profile Picture
    Loic Orue 925 on at
    RE: Execute "as the workflow owner" and problem with impersonation

    Hi Debra,

    How about linking that security profile to a Team, then adding the parent workflow's calling user to said team:

    github.com/.../Add%20User%20To%20Team.md

    And then removing it after the child workflow's execution:

    github.com/.../Remove%20User%20From%20Team.md

    Not elegant, but your user would belong to the team with the proper Security Profile for the time the workflow is ran.

    Regards,

    Loïc

  • Cyclefitness Profile Picture
    Cyclefitness on at
    RE: Execute "as the workflow owner" and problem with impersonation

    I have confirmed that even with the correct security role, the service account's security profile is not being used.  It's reading the profile of the calling user from the parent on demand workflow.

  • ashlega Profile Picture
    ashlega 34,475 on at
    RE: Execute "as the workflow owner" and problem with impersonation

    Hi Deb,

     I am pretty sure if it's configured to run under the workflow owner account, you just need to give that account required permissions.. at least it's worth a try

  • Cyclefitness Profile Picture
    Cyclefitness on at
    RE: Execute "as the workflow owner" and problem with impersonation

    Thanks, Alex.  I just checked and the service account did not have a role with privileges.  I'm going to test in a few minutes, but the error is not saying that user doesn't have privileges, it's saying the "throwing" user doesn't; the user running the on demand workflow.

  • ashlega Profile Picture
    ashlega 34,475 on at
    RE: Execute "as the workflow owner" and problem with impersonation

    Hi Deb,

     what security roles are assigned to that service account? Does it have permissions to update the general ledger (not only through the field security, but through the security role first of all)?

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

December Spotlight Star - Muhammad Affan

Congratulations to a top community star!

Top 10 leaders for November!

Congratulations to our November super stars!

Tips for Writing Effective Suggested Answers

Best practices for providing successful forum answers ✍️

Leaderboard

#1
André Arnaud de Calavon Profile Picture

André Arnaud de Cal... 291,269 Super User 2024 Season 2

#2
Martin Dráb Profile Picture

Martin Dráb 230,198 Most Valuable Professional

#3
nmaenpaa Profile Picture

nmaenpaa 101,156

Leaderboard

Featured topics

Product updates

Dynamics 365 release plans