Access Denied error while using SPWeb.EnsureUser in SharePoint

At some point of time you may need to call (SPWeb).EnsureUser from your custom SharePoint web application. But this method can not be called by everyone, as it requires some high level permissions.

You may also get an error like this:

----------------------------------------

Error: Access Denied

Current User

You are currently signed in as: DOMAIN\USER

Sign in as different user

Request access

-----------------------------------------

Solution:

The solution for this is to wrap the EnsureUser within RunWithElevatedPrivileges call. However, there is a big catch.

NOTE: If you use instances of SPSite or SPWeb, obtained prior to the RunWithElevatedPrivileges block, it won't work as expected because they are already associated to a non-elevated security context.

To illustrate it with code, here is WRONG usage of RunWithElevatedPrivileges:

SPWeb web = SPContext.Current.Web;

SPSecurity.RunWithElevatedPrivileges(delegate()

{

// NOTE: Wrong, do not use

SPUser someUser =web.EnsureUser(web.CurrentUser.LoginName);

});

And here is a CORRECT one:
SPWeb web = SPContext.Current.Web;

SPSecurity.RunWithElevatedPrivileges(delegate()
{
using (SPSite elevatedSite = new SPSite(web.Site.ID))
{
SPWeb elevatedWeb = elevatedSite.OpenWeb(web.ID);
SPUser someUser = elevatedWeb.EnsureUser(web.CurrentUser.LoginName);
}
});

Basically we used the IDs of the Web and Site objects, obtained prior to the elevated block, and used them to create Site and Web object within the elevated context.