IIS 5 & IIS 6
Web Site permissions
Last post Feb 17, 2009 08:28 AM by qbernard
Oct 31, 2008 04:30 PM|renMike|LINK
I've got a number of ASP.NET applications running through IIS. All but one work fine and the one that doesn't claims not to have access rights to the System.Web file or one of its dependencies (Event ids 1088 and 1334). I suspect that the dependency it can't
get to is the System.Web.Security.AuthorizationStoreRoleProvider as this is only referenced by this application. I thought that this meant I had to grant access to the NETWORK SERVICE account to the System32 folder to enable it to see the azroles.dll, but
this doesn't seem to work.
Nov 02, 2008 10:42 PM|tanmayathopate|LINK
Can you provide the error received on the page, when you access the ASP application.. so that it will help us to konw which path and which user needs to have access.
Nov 03, 2008 08:33 AM|renMike|LINK
The first error is Event ID 1334 and it's message is:
Failed to initialize the AppDomain:/LM/W3SVC/1/Root/AzManTestApp
Message: Could not load file or assembly 'System.Web, Version=220.127.116.11, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. Access is denied.
StackTrace: at System.Reflection.Assembly._nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, Assembly locationHint, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection)
at System.Reflection.Assembly.nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, Assembly locationHint, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection)
at System.Reflection.Assembly.InternalLoad(AssemblyName assemblyRef, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection)
at System.Reflection.Assembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection)
at System.Activator.CreateInstance(String assemblyName, String typeName, Boolean ignoreCase, BindingFlags bindingAttr, Binder binder, Object args, CultureInfo culture, Object activationAttributes, Evidence securityInfo, StackCrawlMark& stackMark)
at System.Activator.CreateInstance(String assemblyName, String typeName)
at System.AppDomain.CreateInstance(String assemblyName, String typeName)
at System.Web.Hosting.ApplicationManager.CreateAppDomainWithHostingEnvironment(String appId, IApplicationHost appHost, HostingEnvironmentParameters hostingParameters)
at System.Web.Hosting.ApplicationManager.CreateAppDomainWithHostingEnvironmentAndReportErrors(String appId, IApplicationHost appHost, HostingEnvironmentParameters hostingParameters)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
The second error is Event ID 1088 and it's message is:
Failed to execute request because the App-Domain could not be created. Error: 0x80070005 Access is denied.
As I say, it seems to be indicating the that permissions on one of the System.Web objects is not available, but I don't know which one.
Nov 03, 2008 08:51 AM|qbernard|LINK
Nov 03, 2008 09:57 AM|renMike|LINK
I've obtained and run procmon and I guess that i'm looking for Process Name = w3wp.exe processes? In any request made of the failing application I get seven Results that <> SUCCESS. These are:
No such file x 1 (trying to get to C:\WINNT\assembly\GAC_32\mscorlib\18.104.22.168__b77a5c561934e)
Path not found x 4 (trying to get to C:\WINNT\Globalization\en-gb.nlp, C:\WINNT\Globalization\en-us.nlp, C:\Documents and Settings\Default User\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config, C:\Documents and Settings\Default
User\Application Data\Microsoft\CLR Security Config\v2.0.50727.42\security.config.default)
Fast IO Disallowed x 1 (trying to get to
Access Denied x 1 (trying to get to
I guess the last error is the one that is stopping me from accessing the application but I don't know enough about the rest to say how much of a problem they are?
The Access Denied error is attempting to CreateFile as its operation and is running under the NT AUTHORITY\NETWORK SERVICE account. The folder in question has inherited permissions for the group of 'Everyone' that allow it Full Control.
Any ideas on what could be stopping the file from being read?
Nov 03, 2008 10:52 AM|renMike|LINK
I'm not sure if this is the complete solution yet but, I compared the IIS6 properties of one of my working applications to the one that was failing. I noted that the failing one was looking for its content based on 'A share located on another computer' and
not 'A directory located on this computer'. When I changed the failing apps properties I got a little further as it's now telling me that I have insufficient rights to run the site, which I think is part of the security I'm attempting to run.
I'll let you know how I get on.
Nov 03, 2008 11:20 AM|renMike|LINK
How daft do I feel!
That was the problem. Somehow when I set up the application in IIS6 I set it up to read from another server rather than locally and that threw the error. Changing this property back to read from the local server it all started to work again.
Sorry for taking up your time, but thanks to those who helped out.
Nov 04, 2008 09:25 AM|qbernard|LINK
Feb 12, 2009 09:38 AM|lester_pb|LINK
I have the same problems, but when I set it up to read from another server by hostname(ex:\\hostname\wwwroot), it is work. But when I set it up to read from the same server by IP(ex:\\ip_address\wwwroot), it will produce
the same error messages....
Anybody have any ideas? Thanks!
Feb 17, 2009 08:28 AM|qbernard|LINK