"Access Denied" given when out-of-box Approval workflow starts - user has Full Control

Question

Hi all,

I'd appreciate any tips on the following issue:

We have a Document Library where we have configured Versioning as follows:

- Require Content Aproval - Yes;  

- Create major and minor versions;  

- Who should see draft items - Only users can edit items;  

- Require checkout - No.

We have added an out-of-box workflow using the 'Approval - SharePoint 2010' template to the library. It's configured as follows: 

- Tasks and History lists are standard, they inherit permissions from the site; 

- 'Allow this workflow to be manually started' is checked;

- 'Start this workflow to approve publishing a major item' is checked;

- Approvers: one user who has Full Control is listed;

- The last checkbox 'Enable Content Approval - update status when workflow is completed' is checked.

The Problem: 

when any user, including those who have Full Control on the site, library, and Tasks/History lists, tries to Publish a document, an Access Denied error is given.

I've checked the permissions thoroughly and I've given the user I'm testing with Full Control everywhere, even though they are also an SCA. I also gave the System account Full Control, in case this was needed due to workflows being involved, and the issue remains.

The issue occurs on all subsites/libraries in the Production environment, and also everywhere on the Test environment, which has the same setup as Production.

When I create a new web application with a 'Basic Site' site and new library, admittedly the issue does not occur, so this is not an issue with SharePoint or the version of SharePoint.

I've checked the ULS logs, and there is very little there other than the Access Denied message, suggesting it is working as it should. But I can't see why it is giving Access Denied, or what Access is being Denied.

Can anyone suggest what type of problem might be occurring here? Or even how I can determine what access is being denied? I tried running a SQL trace but it didn't lead me to the cause of the issue.

I'll add one line from the ULS logs below in case it helps. Thank you.

03/23/2012 12:30:18.90         w3wp.exe (0x13E0)                                0x0664    SharePoint Foundation           Workflow Infrastructure         72er                Medium                  System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))     at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(Exception ex)     at Microsoft.SharePoint.Library.SPRequest.OpenWeb(String bstrUrl, String& pbstrServerRelativeUrl, String& pbstrTitle, String& pbstrDescription, String& pbstrTitleResourceId, String& pbstrDescriptionResourceId, Guid& pguidID, String& pbstrRequestAccessEmail, UInt32& pwebVersion, Guid& pguidScopeId, UInt32& pnAuthorID, UInt32& pnLanguage, UInt32& pnLocale, UInt16& pnTimeZone, Boolean& bTime24, Int16& pnCollation, UInt32& pnCollationLCID, Int16& pnCalendarType, Int16& pnAdjustHijriDays, Int16& pnAltCalendarType, Boolean& pbShowWeeks, Int16& pnFirstWeekOfYear, UInt32& pnFirstDayOfWeek, Int16& pnWorkDays,...   ad539737-73bc-48ad-828b-10cf38768317

Answer 1

Two other points to add:

1) When error occurs, the following is logged in Workflow History:

"The workflow could not update the item, possibly because one or more columns for the item require a different type of information."

I've Googled this but didn't find a solution.

2) If I change the options for the workflow so that:

- 'Start this workflow to approve publishing for a major item' is NOT checked;

- Instead, 'Start this workflow when a new item is created' IS checked;

- The 'Enable Content Approval - update status when workflow is completed' is NOT checked

Then for new items, the workflow starts fine, and the task is created. Just mentioning this to show the permissions to start workflows and create tasks etc are fine. thanks

Answer 2

We resolved this issue by deactivating and reactivating two Site Collection features: Workflows and Publishing Approval Workflow.

In between deactivating and reactivating, we also did an iisreset and deleted the problematic workflow 'Approval - SharePoint 2010' in SharePoint Designer. Reactivating the feature recreates the workflow.

On thing I hadn't mention is that our environment was an upgrade - a 2007 content database was attached to SharePoint 2010. It seems this issue may have been present since that upgrade, as the workflows in Designer still had Modified and Modified By values from the date of the upgrade. That upgrade had ran with no errors however.

It makes sense that de- and re-activating site collection features resolved it, as the issue was only occurring everywhere in this site collection, not in other site collections or web applications.