Access denied error when creating a Document Library from a custom List Definition

I just ran into an issue that I’m pretty sure I also had about a year ago, but failed to write down then. I guess I’ll have to write it down this time. I’m creating a custom list definition and after I deployed the solution and instantiated the list I got an error saying “Access denied. You do not have permission to perform this action or access this resource.”, even though the permissions is set to inherit and I am the site owner and have full control.

Unfortunately, I spent more time on this than I should have. I have a bunch of documentation printed from MSDN, including the documentation on the ListTemplate element. I never flipped to the last page of my printout, where the community content is showing others running into the same issue. If I had gone to MSDN and read the page there, I might have noticed this earlier.

Anyhow, take a look at this list definition:

Code block

<?xml version="1.0" encoding="utf-8"?>
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    <ListTemplate
       Name="RevisionLibrary"
       Type="10001"
       BaseType="1"
       OnQuickLaunch="TRUE"
       Sequence="308"
       DisplayName="Blah"
       Description=""
       Hidden="False"
       EnableModeration="True"
       VersioningEnabled="True"
       Image="/_layouts/images/itdl.gif" />
</Elements>

That was my code when I was experiencing the issues. I’m in the early stages here, so it’s a little crappy, but you get the point. I had created the list template from scratch, using the MSDN documentation. Still, it didn’t work and I couldn’t figure out why. I tried looking in the logs, which were of no help because the list was created successfully, and I tried Googling it but I couldn’t find a solution.

Eventually I was pretty sure it was an issue with the template, and I ended up comparing my template to one I had created previously (about a year ago).  I kept removing/adding attributes until I finally got a working list. Turns out the culprit was the SecurityBits attribute.

Looking at the documentation, it has this to say about the SecurityBits attribute:

Code block

Optional Text. Defines the item-level permissions in the list for users with sufficient permission to read or edit list items. The SecurityBits attribute contains a 2-digit string. The first digit in the string controls the read access; the second digit in the string controls the edit access. For read access, the following are valid digits:

1   Users can read all items.
2   Users can read only their own items.

For edit access, the following are valid digits:

1   Users can edit all items.
2   Users can edit only their own items.
4   Users cannot edit items.

Note: Users with the ManageLists permission can read and edit all items, regardless of value of the SecurityBits attribute.

This attribute does not apply to document libraries.

Notice that last sentence? I didn’t include that attribute deliberately because MSDN said it would have no effect. OK so I’m also working off a 2 year old print out here, but in my defense, it hasn’t changed since I printed it.

I changed the code to this:

Code block

<?xml version="1.0" encoding="utf-8"?>
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    <ListTemplate
       Name="RevisionLibrary"
       Type="10001"
       BaseType="1"
       OnQuickLaunch="TRUE"
       SecurityBits="11"
       Sequence="308"
       DisplayName="Blah"
       Description=""
       Hidden="False"
       EnableModeration="True"
       VersioningEnabled="True"
       Image="/_layouts/images/itdl.gif" />
</Elements>

I think the result speaks for itself:

So to sum it up. If you are creating a Document Library list definition and you get a weird error saying “Access Denied”, make sure your ListTemplate element is specifying a SecurityBits attribute. Or you’re going to be sorry.

I haven’t checked this in 2010, although I plan to do so, but the documentation still says that the attribute does not apply to Document Libraries.