Access denied on RenderAction - asp.net-mvc-3

I am working on a new project and am trying to log into the site (it uses forms authentication), but as soon as I log in I get this error.
Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.
Source Error:
Line 10:
Line 11: <div id="partialListOfAuctionsDiv">
Line 12: #{ Html.RenderAction("PartialListOfAuctions"); }
Line 13: </div>
Line 14: </fieldset>
The line that is highlighted as the source of the error is
#{ Html.RenderAction("PartialListOfAuctions"); }
I have no idea what this might mean and how to solve it. Any help would be greatly appreciated.
Thanks,
Sachin

It looks as if the ASP.NET process does not have physical access to the web folder. The fact that you can access the site before you are authorized implies that MVC can access the files before then; this implies that its credentials are being changed after you log in. This only happens, I believe, when you have Impersonation turned on. Look for this line in your web.config:
<identity impersonate="true" />

Related

Security Exception in MVC3

Hi I met the following problem when achieve a function "send an email to members" in my membership application. I did some research and add
<system.web>
<securityPolicy>
<trustLevel name="Full" policyFile="internal"/>
</securityPolicy>
</system.web>
to my Web.config, then deployed to server again, but the problem still exists. Any ideas? Thanks in advance.
Server Error in '/TestApp' Application.
Security Exception
Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.
Exception Details: System.Security.SecurityException: Request for the permission of type 'System.Net.Mail.SmtpPermission, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
When sending the email you might be specifying the SMTP port number which might not be allowed.
Here is an example of what I'm talking about:
SecurityException: Request for the permission of type 'System.Net.Mail.SmtpPermission'

different 401 errors depending on where authorization happens

I have a question regarding authorization in MVC3.
I'm currently looking at dening certain user access to the application.
I can du this in 2 ways. in the web.config (for global settings) or on the individual controllers (or actions).
But I see a different behaivour in these 2 approches.
when a user is denied access using web.config settings, they get a 401.2 error page stating "Access is denied.".
If they are denied access using a controller setting they still get a 401 response, but a blank page.

Error (0x80070542) in website using custom account in application pool

My ASP.NET MVC 3 website was working fine, and then this afternoon I started getting a 500 error, although the only thing I changed was to enable 32-bit applications. I changed that back but the error remains. I've even deleted my app pool and web site and recreated them in IIS with no luck.
If I revert the app pool back to AppPoolIdentity I do not get this error (but I cannot access my database then, I need that custom account to read my database with integrated security).
Can anyone point me in the right direction?
ModuleName IIS Web Core
Notification 2
HttpStatus 500
HttpReason Internal Server Error
HttpSubStatus 0
ErrorCode 2147943746
ConfigExceptionInfo
Notification AUTHENTICATE_REQUEST
ErrorCode Either a required impersonation level was not provided, or the provided impersonation level is invalid. (0x80070542)
UPDATE:
I enabled impersonation and impersonated a user with admin access to the machine. I received this error in response, which does not tell me much more:
Could not load file or assembly 'Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. Either a required impersonation level was not provided, or the provided impersonation level is invalid. (Exception from HRESULT: 0x80070542)
Well, a full uninstall and reinstall of IIS managed to do the trick for me.
I had to follow the instructions here: http://forums.iis.net/t/1170286.aspx in order to do it properly.

COM+ Objects with IIS 7.0

I am converting PPT to images using ASP.NET code. When i run my code Directly (no IIS 7.0 involved) its runs perfect. But when i configure my application to IIS 7.0 and then run the application its giving me the following error:
Retrieving the COM class factory for component with CLSID {91493441-5A91-11CF-8700-00AA0060263B} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.UnauthorizedAccessException: Retrieving the COM class factory for component with CLSID {91493441-5A91-11CF-8700-00AA0060263B} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).
ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.
Source Error:
Line 12: ' Create an instance of PowerPoint, make it visible,
Line 13: ' and open Pres1.ppt.
Line 14: Dim oPP As New PowerPoint.ApplicationClass()
Line 15: oPP.Visible = MsoTriState.msoTrue
Line 16: Dim oPresSet As PowerPoint.Presentations = oPP.Presentations
Source File: G:\Projects\PPTTest\Default.aspx.vb Line: 14
Stack Trace:
[UnauthorizedAccessException: Retrieving the COM class factory for component with CLSID {91493441-5A91-11CF-8700-00AA0060263B} failed due to the following error: 80070005 Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).]
_Default.PPT() in G:\Projects\PPTTest\Default.aspx.vb:14
_Default.Page_Load(Object sender, EventArgs e) in G:\Projects\PPTTest\Default.aspx.vb:8
System.Web.UI.Control.OnLoad(EventArgs e) +91
System.Web.UI.Control.LoadRecursive() +74
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2207
Please someone help me out of this situation. I am using windows server 2008, Visual Studio 2010 with ASP.NET Framework 4.0, , using form based authentication.
Thank you
it has been resolved by giving permissions to "This User" and then give you login credentials in COM+ settings.

403 Forbidden: Access is Denied - Hosting MVC 3 Project

I am trying to host MVC Project and this Error Show :
403 - Forbidden Access Is Denied
You do not have permission to view this directory or page using the credentials that you supplied
I
1-Added Virtual application
2-Changed the application pool to ASP.NET v4.0
3-Added Permissions ( IIS Users ) gave it full controll
4-Changed the Identity to LocalSystem
5-Tested my ConnectionString and its SQL Authentication atm with SuperAdmin
That worked on my laptop as local but when i tried to do that on my Server it gives the previous Error
If you're using Windows/Forms Authentication in your application, make sure that you enable the correct option under the Authentication section (IIS7)

Resources