Why do we need to add NT AUTHORITY\SYSTEM to impersonation users?

Question

A customer is experiencing a problem which seems to be related to the Razor Mediator.

They have a template which makes use of a webdav connection in it. When they publish a page using the template they get the following error:

RazorHandler: Error import of '/webdav/500%20Public%20bpfBOUW%20Website/Building%20Blocks/System/Templates/000%20Algemeen/RPT_test_imports_lho.cshtml'. Tridion.ContentManager.AccessDeniedException: Impersonation by this user requires the NT AUTHORITY\SYSTEM account to be configured as impersonation user. at Tridion.ContentManager.Security.AuthorizationManager.GetImpersonationUserSettings(String name) at Tridion.ContentManager.Security.AuthorizationManager.LoadAccessToken(String userName, String impersonationUserName) at Tridion.ContentManager.Session..ctor(String userName) at Tridion.Extensions.Mediators.Razor.RazorHandler.get_Session() at Tridion.Extensions.Mediators.Razor.RazorHandler.GetImportTemplateContent(String path)

Component: Templating

Errorcode: 0

User: NT AUTHORITY\SYSTEM

When adding the NT AUTHORITY\SYSTEM account to the impersonation users, the errormessage is not thrown anymore. The question is why there is a need to add this user to the impersonation users?

Answer 1

Its probably got something to do with the AdminUser which can be configured in the Razor Mediator configuration. From the docs:

AdminUser Attribute The "adminUser" attribute allows you to specify a username of a Tridion User with system administration rights. Note that this is currently only required if you plan to use imports to other Razor Template Building Blocks. If you only import external razor templates located on the CMS server, this field is unnecessary.

Is this set up? If so, is that user a valid Tridion sys admin? It could also be that the process which is trying to impersonate as that user is running under the SYSTEM account, which would explain the error you see.