I've been working on an asp.net 4.0 website and seem to be having an issue with deleting from the database stored in the app_data folder.
I created a domain group in the actice directory and used the web.config file to restrict access to certain pages that allow modifcation of the database. Everything worked fine on my test machine and the production server, but the issue is that on the server, even though it recognizes the user when you access the page, when you try to delete an item it denies access and does not allow you to delete the item.
The users had read/write permissions to the folder, but it still denied access. I did some testing and allowed everyone read/write acces, and it allowed me to delete, but I don't like having that option set up.
Does anyone know what causes this issue and what the proper fix would be? I'm assuming I have to let the website know which user is running the application before it tries to delete so they can write to the database, but I thought it would do that automatically since I used Windows authentication.
If anyone has any information I would greatly appreciate it.
The user account that is running the application pool for your website is the only user account that needs MODIFY permissions to that database file.
Related
I've internal Asp.Net Core Site running on IIS10 in my company.
Now i thought its a good idea to access pdf files from another server via a virtual directory. (Maybe someone has another idea)
We have 1 Server with Active Directory User, the File Server and the Server where IIS is running.
I tried absolut everything with permissions, at the end nearly everything had Admin Access but IIS still keeps meaning it has not enough permissions.
(Maybe i missed a restart at some point, i dont know)
I read much about the iis_iusrs the active directory has no user only a group where i added the iis user.
Other way giving the folder iisServer\iis_iusrs permissions isnt accepted
I've this error:
https://learn.microsoft.com/en-us/troubleshoot/iis/http-error-500-19-webpage
I read that its not the web.config but tried also many permission options.
At the end i'm pretty confused, didnt think that its so complicated or maybe i'm doing everything wrong
Maybe someone knows a way for dummys which always work.
You can try this way to slove the question:
Open the Internet Information Services.
Expand the root node, expand Sites, and right-click on your Application, click Manage Web Site ->Advanced Settings.
Note down the Application Pool name under General settings and close the window.
Now go to Application Pools section, here you can see what Identity is used in the corresponding Application Pool.
Here, the user account testuser1 is configured in Application Pool. So we need give required permissions for this user in the website directory.
Go the abother web directory folder, right-click on the folder and click Properties.
Set required permissions for the Identity(testuser1) that used in ApplicationPool.
Restart Application Pool and Web Application and try again.
I have just finished a project and deployed to the server but am facing few problems while trying to log in in the application.
After following few articles, I managed to set-up the IIS and ended up creating a new log in account named as "NT AUTHORITY\ANONYMOUS LOGON" with permissions for SQLServer.
At the moment, I am able to see the log-in page, but whenever I try to actually log-in, the response comes to the same page so I don't know whether it could be anything related to FormsAuthentication or just SQLServer.
I changed permissions to NT AUTHORITY\ANONYMOUS to see what would happen, and whenever there is no permissions, it returns an error mentioning about the select to verify whether user exists.
I am assuming that the select is being triggered but for some reason the user is not being redirected.
Would anyone have ever experienced that? Any hint?
I would like to state that the application runs ok locally.
----- EDIT [SOLVED]
After spending some time trying to fix this problem I have realized that the problem was actually because I am using CRM and its FilteredViews which allow only users having WindowsAuthentication to retrieve data from those views since they must be part of CRM. Therefore, I needed to change my web.config to continue using Integrated Security as True and changed my IIS config to allow impersonate passing an domain account for log-in.
I hope any1 who may have same problem is able to fix that. Otherwise I am glad to help!
Thanks in advance,
Dem
Check if anonymous access is enabled in IIS/Authentication for your website
I know this question has already been already many times,but doesn't help me tackle my equation.
I currently have a Folder shared for the respective users to be zipped when the user calls the service. I get Access to the path \\IP\FolderName is denied. On research, I found out several solutions for this issue, but none worked.
I tested by trying to zip the files inside the folder and was able to do it successfully. I do not know what might be the issue! I even tried going the bad way by giving permission for Everyone for the folder (out of frustration though) and still was not successful.
My Anonymous, Asp.Net Impersonate and Windows Authentication were enabled.I do not know what might be the issue.
PS: Could I know in what identity the IIS is accessing the folder, so that I can give permissions only to that User.
I can not help you with your main problem, but for the following:
Could I know in what identity the IIS is accessing the folder, so that I can give permissions only to that User.
You need to check what Application Pool is assigned to your application in IIS. Then go to the application pools section and there the user is listed:
As mentioned by Chrfin you need to first find out the Application pool used by your application(Ex: DefaultAppPool, ASP.NET v4.0 etc). Right click on the relevant App pool and go to Advanced Settings there you should see the Identity.
But best way is to go for impersonation, Check this thread for more details. With impersonation what you do is, Giving required folder access permission to an admin user on the web server and whenever you try to access these folder from within your code, you impersonate particular code block,
Using(Impersonator impersonator = new Impersonator())
{
//Write the folder accessing logic here
}
I am trying to create a Directory in .NET using Directory.CreateDirectory, I followed the directions here to give access permission but I am still getting an UnauthorizedAccessException. Does anyone have any advice? Note, this is a web application that uses the IIS7 server.
In the directory you are attempting to create a new directory, make sure that your app pool user has Read/Write permissions for that directory. You have to specifically do that in addition to adding the user to the user groups.
2 more potential issues (+1 to user959729):
you are creating directory at different place than you think you are (i.e. you building path wrong)
the code runs under impersonated account (user's or anonymous) and such user does not have permissions to create folder (to verify try check System.Environment.UserName before creating directory). To fix you need to run code as process account.
I am currently creating a folder and writing a file to the folder that need to be create on a file server that we have. When i do a localhost test, it work perfectly but when i access the website from outside the localhost and from another pc. It said that
System.UnauthorizedAccessException: Access to the path 'My File Server
URL' is denied
ASP.NET is not authorized to access the requested resource. Consider
granting access rights to the resource to the ASP.NET request
identity. ASP.NET has a base process identity (typically
{MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6) that is used if
the application is not impersonating. If the application is
impersonating via , the identity will be
the anonymous user (typically IUSR_MACHINENAME) or the authenticated
request user.
To grant ASP.NET access to a file, right-click the file in Explorer,
choose "Properties" and select the Security tab. Click "Add" to add
the appropriate user or group. Highlight the ASP.NET account, and
check the boxes for the desired access.
But the thing is that i have already set the identity impersonate="true" in the web.config and it still didn't work. My web server is running on Winder Server 2003 and IIS 6
Any advice and help will be deeply appreciated
Thanks
Brandon
You need to grant write, modify permission to the Users group for that file/folder.
Check your IIS Authentication setting and make sure that Anonymous authentication is enabled.
Hi Guys i manage to find the solution to it
If u are creating a folder, using this code before file or folder creation
WindowsImpersonationContext ctx = WindowsIdentity.Impersonate(IntPtr.Zero);
// Insert the create code here
ctx.Undo();
Well i do not know if this is the best solution. if anyone know the downside or implication of this code please share and comment.
no harm knowing more