How can I solve 'Access Denied' with ASP and Windows 7? - asp.net-mvc-3

I’m trying to save a file like this:
FileStream file =
new FileStream(“C:\\temp”, FileMode.Create, System.IO.FileAccess.Write);
Byte[] bytes = new byte[file.Length];
File.Read(bytes, 0, (int)file.Length);
File.Write(bytes, 0, bytes.Length);
File.Close();
File.Close();
I then get this error:
Access to the path ‘C:\temp’ is denied. Description: An unhandled
exception occurred during the execution of the current web request.
Please review the stack trace for more information about the error and
where it originated in the code.
Exception Details: System.UnauthorizedAccessException: Access to the
path ‘C:\temp’ is denied.
ASP.NET is not authorized to access the requested resource. Consider
granting access rights to the resource to the ASP.NET request
identity. ASP.NET has a base process identity (typically
{MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and
the configured application pool identity on IIS 7.5) that is used if
the application is not impersonating. If the application is
impersonating via , the identity will be
the anonymous user (typically IUSR_MACHINENAME) or the authenticated
request user. To grant ASP.NET access to a file, right-click the
file in File Explorer, choose “Properties” and select the Security
tab. Click “Add” to add the appropriate user or group. Highlight the
ASP.NET account, and check the boxes for the desired access.
I’ve done this on both my Windows 7 and Windows 8 machines and got the same error message. I’ve changed the administrator role on the pc, given full control to all users, removed the ‘Read Only’ attribute from the file and still got the same error. I even tried using a thumb drive.
I also noticed that after removing the ‘Read-Only’ attribute from the file, it always returns as if the setting did not take.
I also tried this fix with the Windows 7 machine: http://fixmywin.com/fix-windows-7-access-denied-error-and-permission-ownership-problem/...but still the same errors. I gave up after about fie hours with this problem. How can I fix this?
Thanks for any help!

Look in IIS at the ApplicationPool the site is running under, select "Advanced Settings" and find the user the App Pool is using. This will typically be "NETWORK SERVICE" unless you have specifically changed it. Then, right click on the folder c:\temp >> Properties >> Security and add "NETWORK SERVICE" (or other user) with "Modify", "Full Control" or the appropriate permissions for your app.

Related

MVC3 web site on IIS 6

When I try to deploy an ASP .NET MVC 4 web app on IIS 6, I get the error saying
Access to the web.config is denied.
Identity of the app pool of the web site : Network Service
The folder C:\inetpub\wwwroot\ appname has full Control access by Network service. But I am confused whether this permission gets applied recursively.
How can I get the site working ?
Screenshot of the error
If you check the directory security of the website, see if it is set to anonymous. If it is, grant the IISUSR read access to the directory.
If it is windows authentication or some other method, and the .Net is set to impersonate, you will need to grant them access too.
HTH
Si
Try to set the Application Pool setting as Default pool or .Net Frame Work Version :4.0

IX509PrivateKey::Create throws access denied when called as "Network Service"

I'm using IX509PrivateKey to create a key for an X.509 cert request (as "NT AUTHORITY\NETWORK SERVICE"), and the Create method is generating an access denied (I'm P/Invoke-ing the dispatch interface from C#, so the HRESULT is getting translated to a .NET exception). Process Monitor also shows an access denied attempt to access the key file (the key file is being created).
Here's the actual code:
IX509PrivateKey privateKey = new CX509PrivateKey() as IX509PrivateKey;
privateKey.Length = request.KeyLength;
privateKey.ExportPolicy = X509PrivateKeyExportFlags.XCN_NCRYPT_ALLOW_EXPORT_FLAG;
privateKey.KeySpec = X509KeySpec.XCN_AT_SIGNATURE;
privateKey.KeyUsage = X509PrivateKeyUsageFlags.XCN_NCRYPT_ALLOW_ALL_USAGES;
privateKey.MachineContext = true;
privateKey.Create();
return privateKey;
If I create a user key set instead (by setting MachineContext to false), I see a "File Not Found" instead of "Access Denied". But ProcMon shows nothing; no attempt to access any key files.
In Process Monitor, I was able to determine that "Network Service" did not have access to the key file, so I used the IX509PrivateKey::SecurityDescriptor property to set it. "Network Service" indeed then had access to the key file, but I still received the access denied from Create, and ProcMon still showed an access denied attempt on the file.
Much TIA for any and all ideas.
The cause of this issue has been determined.
The call to IX509PrivateKey::Create was occurring within a web service. As a result, it was occurring under impersonation of IUSR. We edited ACLs enabling the wrong user. It turned out to be straightforward access denied, only for an obfuscated user account. This condition can be observed in ProcMon. ProcMon's "Detail" column will clearly indicate (you may have to enable "Advanced Output")that the call was under an impersonated user account.
In order to more tightly control the user account under which the call is made, and the CA is accessed, we moved the request out-of-process. The enrollment API calls are now made from their own Windows service, and exposed via WCF (net.tcp) to the web service running in IIS. That would be my recommendation for others. IMO, the risk of having another "moving part" is outweighed by the lack of control of making the calls within IIS.

How do I access a NAS through my ASP.NET MVC Application?

I'd like to access a Fileserver (NAS) through my ASP.NET MVC Application and can't find a way to do that in a correct way.
What I've done so far is:
Created a User with Read/Write permissions on a directory on my NAS
Created a virtual directory on my IIS Server that is connected to the nas directory with the previously defined usercredentials
Now if I navigate to my virtual directory (AppliCationIPAdress/NAS) I get automaticaly redirected to \NASIPAdress\My\Directory. On the NAS loginnotifications I get the info, that somewone connected to my directory with the given credentials => That is how it should be
But if I access the NAS directory trough my MVC application (no matter if i use the UNC or the virtual directory redirection) i get an access denied erromessage and in the NAS loginnotifications there is not listed my prepared useraccount but my webserver as user who tried to login.
var dirName = Server.MapPath("~/NAS/Dir/");
ViewBag.Message = System.IO.Directory.GetFiles(dirName );
Could someone please explain why that is happening and what I have to do if i want to access files on a fileservice throuh my mvc application?
You have to give the service account rights to access the filearea, or run the app with a user that has rights
What worked for was:
Have same user account and password in NAS and IIS Server.
Create an application pool for your web app or use the default app pool and change the user account to the same mentioned before. Steps:
Go To IIS Manager
Click on Application Pools
Right click on the app pool assigned to your web app and select Advanced settings...
In section Process Model change the Identity field to the user account mentioned above.
Click on the 3 dots button located at the right of the field
Select Custom account and click on Set... button
Set username, password and password confirmation (same user account mentioned above.
Hope it helps!
FranciscoG

ASP.NET MVC 3 Intranet site on IIS7.5 w Windows Authentication gives 401.3 and File authorization failed for the request when trying to log in

I have made an ASP.NET MVC 3 Intranet site with Windows Authentication enabled:
in the Visual Studio project file properties
in the web.config, i.e. <authentication mode="Windows"/>
on the site properties in the IIS 7.5. server
Anonymous access is disabled for all these three above, the web.config says <deny users="?"/>. Impersonation is disabled in the web.config by identity <impersonate="false"/> and on the site properties in the IIS 7.5 server. And finally, the NETWORK SERVICE is set to run the app pool and also has Read on the site folder (not sure if it's needed though, you tell me, but it sure ain't enough to solve my problem below).
Now, when logging in through the standard Windows Authentication dialog box, domain users are presented with a 401.3 error after three valid login attempts. This seems to be before even reaching my MVC site's code, i.e. it seems completely IIS related. The event log gives the following kind of entry (it's an Information entry, not an Error, and I've obfuscated it a bit to protect my client) for all the users that has tried to log in:
Event code: 4008
Event message: File authorization failed for the request.
Event time: 2012-02-20 18:45:41
Event time (UTC): 2012-02-20 17:45:41
Event ID: 6dd3b4bf99784ba1a0fe06694dd89691
Event sequence: 3
Event occurrence: 1
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/2/ROOT-1-129742335229554599
Trust level: Full
Application Virtual Path: /
Application Path: D:\Public\BlahblahManager\
Machine name: HUB01-XYZ123
Process information:
Process ID: 2920
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE
Request information:
Request URL: http://blahblahmanager.user.ad.blah.com/
Request path: /
User host address: 134.XXX.XXX.XXX
User: USER-AD\teh-user
Is authenticated: True
Authentication Type: Negotiate
Thread account name: NT AUTHORITY\NETWORK SERVICE
Custom event details:
It is only when I specifically grant USER-AD\teh-user or USER-AD\Domain users the Read permission on the site's root folder (D:\Public\BlahblahManager) that the user can log in and actually see the site.
Why is this? There must be some kind of configuration that I'm missing. Shouldn't it be enough that the NETWORK SERVICE has Read on the site's root folder? I've Googled this for a while, and impersonation is mentioned here and there, but the jury is still out it seems. Some sites claims that you should go with impersonation and they provide examples on how to do it, but when I try out the examples it still doesn't work. Other sites says that impersonation is NOT the way to go and that you NEED to grant the folder permissions in these cases. But that seems such an odd thing to do. Users have no business on the actual server, they should be working through the website only.
Any suggestions? What is usually the minimum amount of configuration needed to get this to work? Any tips on how to troubleshoot this kind of problem and get to the root cause?
I refer you to see this post that declares all of MVC authentication methods. but make sure you have enabled minimum required authentication on your mvc application. Notice that Anonymous Authentication works with your group policies. you can config that by following : Internet Options -> Security Tab -> Local Intranet -> Custom Level, on your browser.
1- Another thing that may causes the problem is IIS may configured not to authorized related users. Some of them are :
iisservice
IUSR
IIS_IUSRS
Network Service
2- Also Check allowed verbs in IIS.
3- On the root folder of your application Give read access to IIS AppPool\YourAppPool.
4- Another cause could be hierarchical access rules in your application depends on what application services you are using, like web site panel access rules.
5- Setting the clientaccesspolicy.xml file.
6- Check InitializeService() Method, do you set entity access rules properly? For example:
config.SetEntitySetAccessRule("*", EntitySetRights.All);
7- Check FileAuthentication module at the web site level.
Double check Anonymous authentication is enabled on IIS.
Also, have a look at this post.
We were also fighting with this issue, and started setting up security groups so we could give our users file level permissions. Then one of our server admins stumbled across a couple of new properties that allow the app to authenticate to the file system under set credentials, and resolved the need for the users to have access. Here is what he came up with…
There are two IIS settings that control this:
Physical Path Credentials Physical Path Credentials Logon type
By default, Physical Path Credentials is set to Application User
(Pass-through authentication). This means that IIS doesn’t do any
impersonation when handling Windows Authentication requests. This can,
however, be set to a specific user (though not, unfortunately, the
application pool identity, which would be ideal). Physical Path
Credentials Logon Type is set by default to Clear-Text. For my testing
I set this to Interactive (though this may not be the correct value).
Possible values are Clear-Text, Batch, Interactive, and Network.
To set this up I did the following:
Created a local account (IIS-AccessUser)
Granted IIS-AccessUser read and execute access to the /home directory of the site.
Added IIS-AccessUser to IIS_IUSRS group (necessary for accessing .NET temporary files)
Set IIS-AccessUser as the Physical Path Credentials
Set Physical Path Credentials Logon Type to Interactive
Doing the above allowed me to log in to the application directly,
without having to allow Authenticated Users, or me having to be a
member of any of the groups in the /home folder. It also still
preserved .NET Authorization roles, so I still could not access parts
of the site that I was not allowed to.
I also faced this same issue on iis7 with windows authentication, but with with MVC4.
Finally found this post. Hope this might help someone in the future.
You are not required to grant file access permissions when using Windows Authentication in IIS 7.0 and IIS 7.5.
There's a better way that we were only able to discover this because our server admin smelled the security and management issues that arise from taking the route of granting file level access to users and groups.
For anyone dealing with this issue or if you are setting up a new IIS7/IIS7.5 server and/or moving from IIS 6, here is an article that gives you all of the Windows Authentication options and configurations that need to be modified to avoid granting file level access to individuals or groups.
Please read the two comments in at the end of the POST for some valid critiques of the methods used in this article.
http://weblogs.asp.net/owscott/iis-using-windows-authentication-with-minimal-permissions-granted-to-disk
In addition to the information in the article, please be aware that IIS 7.5 is not using the web configuration tags for system.web (at least not in my MVC 4 application).
It is looking in the system.webserver tags for authorization configuration (where you will need to list the windows domain\groups a user needs to be in to access your application).
-- DSB

SSRS 2008 R2 - cannot logon to localhost/reports

When attempting to deploy a SSRS 2008 R2 Report to my localhost/ReportServer, or trying to login to localhost/reportserver (via web browser), I am not able to get any further than a security error message.
When trying to access the report server via a web browser, I'm prompted to enter my login credentials. Even though I am the admin on the box, I still receive the following message:
User 'PCName\Me' does not have
required permissions. Verify that
sufficient permissions have been
granted and Windows User Account
Control (UAC) restrictions have been
addressed.
I have also tried launching my browser in Administrator Mode - same issue.
When attempting to deploy a report from VS, I get a similar message:
The permissions granted to user
'PCName\Me' are insufficient for
performing this operation.
Some assistance would be appreciated.
Thanks.
Mark, thanks for the suggestion. I found the answer here where I had to change the report server's authentication type to local.
<Authentication>
<AuthenticationTypes>
<RSWindowsBasic>
<LogonMethod>3</LogonMethod>
<Realm></Realm>
<DefaultDomain></DefaultDomain>
</RSWindowsBasic>
</AuthenticationTypes>
<EnableAuthPersistence>true</EnableAuthPersistence>
</Authentication>
This satisfies my testing needs, but not secure prod environment needs.
"User 'PCName\Me'" sounds like a local logon - have you tried entering your domain logon (including the domain name before the slash - ie. Domain Name \ User Name) and password?

Resources