Workflow for External Content Type (Associated List) Gives Error

Question

Hello Community.

Background: I have created an external content type, and then an external list from the content type.  Next I created a custom list with the same metadata fields as the external list.  All this works as it should with no issues.  Finally  created a simple 1 step workflow that is designed to update the external list with the data provided in the custom list. 

Problem: When I run the workflow I get the error below:

The workflow could not update the item in the external data source. Make sure the user has permissions to access the external data source and update items. Unknown error
 12/3/2010 8:39 AM Error  System Account

Has anyone seen this before and if so how did you resolve it?

Thanks!

Tom

---

Tom Molskow - SharePoint Architect - Linked-In - SharePoint Gypsy

Answer 1

I learned about this a long time ago, and I think it's pretty obscure.  In order for an SPD workflow to update an external list, you must add permissions for the service account you used as your app pool identity in the content web application where this content resides.  That app pool account must have permissions in the ECT in CA and to the back-end data source.  HOwever, you should be using a group Secure Store Target App for connecting to the back-end source, so really you only need to add the app pool account to the ECT.

---

SharePoint Architect || Microsoft MVP || My Blog
Planet Technologies || SharePoint Task Force

Answer 2

Hey Clayton,

Thanks for that quick answer.  So basically I should determine the account used by the Web Application Pool that my site resides in, and then going through SPD add that account to the ECT as a secondary secure store ID account? Or Impersonate this account?  I'm a little unclear about this point.

Thanks!

Tom

---

Tom Molskow - SharePoint Architect - Linked-In - SharePoint Gypsy

Answer 3

No, you can't add it through SPD.  YOu must add it through the BDC Service Application in Central Admin.  You should have already had to do this for all users accessing this ECT, because they can't access the ECT through the External List otherwise.  These permissions are not set in SPD.  No, you don't add it as a secondary secure store account.  It just gets added as a member of whatever SSID you already created (if you created one).  So, that's two places to add the account - as part of the SSID so that it can be impersonated to the DB and in the ECT itself so that it can execute the ECT connection (both are in Central Admin in separate service apps).

---

SharePoint Architect || Microsoft MVP || My Blog
Planet Technologies || SharePoint Task Force