« Previous Next »

• 01-10-2009, 1:25 PM

  JayRO Joined on 01-10-2009, 4:11 PM Posts 2

  ASP permission problem - HTTP Error 401.3 Reply Contact Problem: a specific Global Security Group can not load ASP pages (but can load HTML pages).  Goal: allow access to the secure website files and directories according to Global Group membership.  This is a medical industry customer, so HIPAA compliance is mandatory (i.e. file access and restrictions must be thoroughly configured and maintained). Environment: Windows 2003 Server, Std. Ed., single server with Active Directory.  IIS is serving a secure website to employees and customers (amongst other non-related functions).  IIS has been configured with a commerical Server Certificate to encrypt communication betweeb the server and clients on the internet.  Anonymous access has been disabled, so users are required to log in to the website with their username/password.  (This was a 2000 Server, upgraded to 2003).  I created a disk partition just for website files. Detail: The employees are members of the Global Group 'Domain Users'.  No problems for the employees to access the website.  The customers are members of the Global Group 'Web Site Users' (and removed from Domain Users group).  There is a virtual directory mapped at the root level of the website named 'CustomerStuff' that maps to the 'CustomerFiles' directory (located at another drive/directory location). In the CustomerFiles directory, I created a simple test.html page which the customer can browse to successfully.  I copied the test.html to test.asp (leaving the HTML markup as-is, no ASP scripting added), and browsing for the customer is denied:  "HTTP Error 401.3 - Unauthorized: Access is denied due to an ACL set on the requested resource." By adding the 'Web Site Users' group to 'Domain Users' group, then browsing ASP pages succeeds.  This solution is not acceptable, as the customers would then have unauthorized access to sensitive patient information. Attempts to resolve: - The permissions for test.html and test.asp are identical (being in the same directory, access to the directory is not an issue). I am fairly certain this is NOT a file permissions issue.  I believe this to be some type of process level or possibly registry access permissions issue. - Using SysInternal's "Process Monitor" app, I have repeatedly monitored browsing of test.html and test.asp both successful and unseccessful access.  Absolutely nothing presents itself as access denied in the Process Monitor log, and I can not detect where the process becomes different for the 401.3 error. - I have turned on failure auditing for: - System drive (including entire WINNT structure). - entire partition<> for ClientFiles, - entire partiton for website files - HKLM in the registry - all Audit Policies available in GPO No FAILURE entries are to be found in the Security log. <> I have attempted every trick I know of (and could find on the internet) to determine what is causing the 401.3 access denied error.  I have also tried numerous tweaks to file structure and User Rights permissions in an effort to find what is needed to allow the ASP page to load (but I am very hesitant to be too aggressive opening permissions, as this site needs to stay secure).  Thanks in advance for any ideas, as I now have over 10 hours troubleshooting this issue.  --Jay Ohman

  Tags: SSLAuthentificationsecurityiis6permissionsIIS 6.0IIS Directory SecuritySpecial PermissionsIis 6.0 SSL IssuesSecurity User Rights AssignmentASPIIS User Rightsiis authenticationIIS6 SecuritySSL Certificateaccess

• 01-10-2009, 3:30 PM

  In reply to

  Rovastar Joined on 03-13-2008, 2:00 PM London, UK Posts 1,797	Re: ASP permission problem - HTTP Error 401.3 Reply Contact Permissions of the actual asp files? .net trust level? *shrug* http://msdn.microsoft.com/en-us/library/wyts434y.aspx   http://www.iisportal.com

• 01-10-2009, 5:49 PM

  In reply to

  JayRO Joined on 01-10-2009, 4:11 PM Posts 2

  Re: ASP permission problem - HTTP Error 401.3 Reply Contact Thanks for the thought.... ASP.NET is not installed at all on this server.  I confess the .net trust level article is rather cryptic to me.  Please advise if this article applies to pure ASP, and if you can a little guidance to temporarily open up the trust level for testing.  If I can determine this is the issue, then I'll go about trying to decrypt the article.     ---Jay R O

• 01-10-2009, 10:09 PM

  In reply to

  steve schofield Joined on 06-10-2002, 8:54 PM MI Posts 3,964

  Re: ASP permission problem - HTTP Error 401.3 Reply Contact Run filemon, regmon while reproducing the error.   In filemon, you can filter to the actual w3wp process to cutdown on clutter.   If filemon, regmon and object failure auditing isn't showing anything, there is something local security policy related.  PS - Also check Windows Share permissions to ensure.   Are you using host-headers? http://support.microsoft.com/kb/294382 Double check your auditing to ensure failures are recorded. http://weblogs.asp.net/steveschofield/archive/2008/03/07/detecting-permission-issues-using-auditing-and-process-monitor.aspx Steve Schofield Windows Server MVP - IIS http://weblogs.asp.net/steveschofield http://www.IISLogs.com Log archival solution Install, Configure, Forget

• 01-13-2009, 4:28 PM

  In reply to

  JaxSpace Joined on 01-13-2009, 9:18 PM Indianapolis, IN, USA Posts 1

  Re: ASP permission problem - HTTP Error 401.3 Reply Contact  I've just wrapped up three days of beating my head against a wall with a very similar problem.  I could access HTML pages, but if you renamed the page extension to ASPX, it bombed.  In FileMon you could see the 401.2 read, then immediately a 401.3 read.  Even though it was recording a successful network login in the Security Event log. In my environment I am also using IWA.  By providing the appropriate group that I wanted to access the site Read permissions to the appropriate .NET framework folder (in my case C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322), the site began to work fine.  Since you are just using ASP, this might be a permissions issue on C:\WINDOWS\system32\inetsrv (to be able to access asp.dll). I hope this helps.  Good luck - Jacques

• 01-13-2009, 4:43 PM

  In reply to

  tomkmvp Joined on 03-20-2003, 6:27 AM Central NJ Posts 6,237	Re: ASP permission problem - HTTP Error 401.3 Reply Contact Use this as a guide for what "other" folders need permissions http://support.microsoft.com/kb/812614 Tom Kaminski IIS MVP http://mvp.support.microsoft.com/ http://blogs.iis.net/tomkmvp/ http://www.linkedin.com/pub/8/690/408 http://www.bluesrepublic.org/