I have a WCF service which I install via cmd line, due to installment on many servers!
When installing application pool and configuring it, I set a custom account on the process model identity, which is just an account with local administrator rights!
But when I try to browse the service just to see the front service page I get a Service Unavailable message with http error 503, which is a server error which again comes from an event id 5021, which states that the identity for the service's application pool is invalid due to either incorrect username/password or the user may not have batch logon rights.
Ergo, the error has to do with the user identity! When I change Identity to NetworkService there is no problem. I cannot either manually set the Identity to the user...
My cmd line looks like:
c:\Windows\System32\inetsrv\appcmd add apppool /name:"calendarproviderservice" ^
/autostart:"true" ^
/managedRuntimeVersion:"v4.0" ^
/processModel.idleTimeout:"24:00:00" ^
/enable32BitAppOnWin64:"true" ^
/processmodel.identitytype:"SpecificUser" ^
/processModel.userName:"PlannerAdmin"
Anyone has a clue...?
Cheers, Finn.
It's been a while, but I finally solved my problem! Unfortunately I didn't sketch the hole scenario in the main question because I didn't think it mattedered in the context. But it did!
The scenario was that my server was a deployed server with a base configuration including IIS 7.5! And this is the problem!
When you try to set the application pool identity to a domain account, IIS has to keep a local copy of your username and password. This is stored in IIS applicationHost.config in encrypted format. In the encryption IIS uses the machine specific keys in iisConfiguration and iisWasKey containers. When this applicationHost.config is moved to a different server (in this case the deployed server on new hardware), IIS can no longer decrypt the password because of the new machine keys.
One can export configuration Keys, but I already deleted the base server I made an image of!
So the lesson learned here is: If you have to deploy many servers with IIS on, make a base image WITHOUT IIS, and script the IIS on the server after deployment!!!
Cheers, Finn.
PS. Dominik, sorry that I wasn't that clear on the intro question!
Have you assigned the user to the local IIS_USRS group?
Related
I have a .Net Core 2.0 application that I host in IIS 7.
With IIS Express the application works fine and I'm able to connect to the database successfully. With IIS I get this error:
Cannot open database "Books" requested by the login. The login failed. Login failed for user 'DOMAINNAME\PCNAME$'.
My connectionString in appsettings.production.json file looks like this :
"ConnectionStrings": {
"BooksDatabase": "Server=PCNAME\\SQLEXPRESS;Database=Books;user id=iisAccess;password=iisPassword;Trusted_Connection=True;ConnectRetryCount=0;MultipleActiveResultSets=true"
};
What am I doing wrong and why does it say that the "login failed for 'DOMAINNAME\PCNAME$'" when I put the credentials user id=iisAccess;password=iisPassword; in my JSON file?
You are asking for Windows Authentication:
Trusted_Connection=True
Remove this part of the connection string and give it another try.
The reason for the error goes along these lines:
IISExpress runs as a normal process in your logon session. So it runs with your Windows Credentials. When your app is running inside IISExpress it is actually running under your credential, and when you connect to the database using Windows Authentication, is your login that SQL Server will receive.
The full IIS on the other hand runs as a service under a different session and a different user account. There are the application pools that also play a part and run under yet another account. But the main thing is that those default IIS accounts are local accounts, so they have no "visibility" to another computers. Hence when your app tries to connect to SQL Server, SQL "sees" the machine account, which goes by the name DOMAIN\MACHINE$.
Most likely, ASPNETCORE_ENVIRONMENT is not set correctly on the server (i.e. either not set at all or not set to Production).
On your server, edit the system environment variables and add one (if it doesn't already exist) with the name ASPNETCORE_ENVIRONMENT and the value Production. Also, edit the advanced settings of your app pool in IIS for the application and ensure that the key Load User Profile is set to True.
I'm just in the process of trying to properly configure asp.net 4.5 on our IIS servers.
I have been able to navigate and launch an ASPX page that contains no data conenctions sucessfully so I know that the application pool authentication to the local directories is working as it should.
Now though I have a seperate SQL server that is connected to the domain and have a connection string stored in the code that connects the ASPX page to the server using a trusted connection. When running in visual studio debug mode, the connection works fine - but at that point I assume it is using my login credentials.
My question is, when a user calls the aspx page via the browser when hosted on the new IIS7 server, which account is used to call the SQL server when using a trusted connection? - Is it the end users or is it a local account from the IIS server?
When I call a page with data connections embedded I get the error: Login failed for user ADMIN\PCNAME$ ... which is an indication that this is the account that it is using. However this account doesn't exist on the domain that I'm aware of. - Or does it ?!
Thanks in advance,
It will use the account that ASP.NET is running under, as you've worked out. What you usually should do is create a Domain Account (with the right privileges) and run your ASP.NET AppPool under that account. Then a Trusted Connection will use that account for connecting to the database, and as long as you've given it access (which as a Domain Account you can do) it should all work.
Added:
After some back and forth on comments, lets go back to the start: set the new AppPool to run with the domain users account, and recycle the AppPoolo. What is it that says the password is wrong? If it's IIS trying to start the AppPool, then it is extremeny likely that the Password you gave the AppPool IS wrong, or else that the password is set to change on first logon.
If its not IIS, but opening a Database connection, are you sure that the database allows this Domain Account access to the database and the tables within it it will need? What roles have you assigned to this account? Also, what SQL statement is it trying to execute (if it's got far enough to try and execute a statement at all)?
I suggest you put any response in you original question - comments get to be a drag if there are too many of them.
BLUF
Our application is attempting to write a file to a UNC folder using an ASP.NET web service running under .NET 4.5, IIS 7.5, and Windows Server 2008 R2. However, any attempt to write the file to the desired location results in an access denied exception.
The task seems simple however me and my team have been troubleshooting this for a while now and we are stumped as to what may be causing the error. Below are the details of our setup and what we have tried and found so far. Names have been changed to protect the innocent.
Environment Setup
The web server, mywebserver, has a website named My.Site.Com with a corresponding application pool named My.Site.Com. The application pool is configured as shown below.
.NET Framework Version : v4.0
Enable 32-bit Applications : False
Managed Pipeline Mode : Integrated
Name : My.Site.Com
Identity : ApplicationPoolIdentity
Load User Profile : False
The UNC path we are attempting to write to is \myotherserver\mydirectories\output where mydirectories is the actual share. On this share a domain group named mygroup-www has been granted full permissions to the share and all subfolders. The machine account (i.e., mywebserver) is a member of this mygroup-www group.
NOTE: For the moment, this UNC path actually lives on the same
machine, mywebserver. However, this will eventually be moved to a machine other
than mywebserver in our test environment and in the production environment
when that it is ready. Currently, I only have the one test environment to troubleshoot with.
The error can be replicated by executing the following code.
[WebMethod]
[ScriptMethod(UseHttpGet = false, ResponseFormat = ResponseFormat.Json)]
public string ExportReport(int reportId)
{
try
{
string output = ConfigHelper.OutputPath + "test.html"; // UNC path
string url = ConfigHelper.VirtualPath + "test.html";
string[] lines = { "Hello", "World!" };
File.WriteAllLines(output, lines); // Access Denied!
return url;
}
catch (System.Exception ex)
{
Logger.ErrorException("Error exporting report", ex);
throw;
}
}
Troubleshooting
Failed Attempts
We tried various combinations of group/user permissions on the folders (listed below). When running these tests we also ran Process Monitor. For each configuration we saw the same result. The w3wp.exe process attempted to create the file in the desired location but reported a result of ACCESS DENIED. The user of each configuration was IIS APPPOOL\My.Site.Com as expected.
Granting mydomain\mymachine$ full permissions to \myotherserver\mydirectories
Granting mydomain\mymachine$ full permissions to \myotherserver\mydirectories\output
NOTE: I have also tried modifying the code so that it would read a
simple file from \myotherserver\mydirectories\output. When
attempting to read the file, the process fails with an ACCESS DENIED
message as it did when writing the file.
Successful Attempts
We also tried several configurations that worked.
Grant the local IIS APPPOOL\My.Site.Com permissions
The first configuration to work was to grant the IIS APPPOOL\My.Site.Com full permissions to \myotherserver\mydirectories The file was successfully written however the process's user was quite unexpectedly a domain account that was set up for a web application on the same machine in another website. This remains very confusing but worked as the 'other' account also has write permissions to the share.
This won't work in production as we cannot use local accounts to grant access to networked resources but is an interesting data point nonetheless.
Change the App Pool Identity to Domain User
The second configuration that worked was to change the My.Site.Com application pool's identify to domain account that had full permissions to \myotherserver\mydirectories. This was a 'vanilla' domain account that was manually created by us. We did not capture what the user of the process was but that may be another useful data point.
This option may be possible, however it breaks away from best practices with IIS 7.5 and may not be allowed in our production environment due to fairly stringent IT policies.
Run the Site On My Development Machine
The third test was to run the site locally on my development machine, mydevmachine. My local IIS configuration is identical to mywebserver with the exception that I am running Windows 7 instead of Windows Server 2008. I granted full permissions for mydomain\mydevmachine to the \myotherserver\mydirectories and ran the application. The file was successfully written. According to Process Monitor the user for the process was correctly set to IIS APPPOOL\My.Site.Com.
Conclusion
We would like to enable write access as designed using the machine account of mywebserver. We have read ApplicationPoolIdentity user cannot modify files in shared folder in Windows Server 2008 and Permissions for Shared Folder for IIS 7 Application Pool Identity Across Domain and Application Pool Identities.
According to this information we should be able use the machine account to grant read and write access to networked resources such as the UNC path. In fact, I can do this in the desired manner when running the web site from my development machine.
There are a couple thoughts that come to mind. Perhaps there is something wrong with the machine account of the test web server. Or perhaps that 'other' software is interfering with the process somehow.
Any thoughts as to what may be causing this issue? What else should we do to troubleshoot?
Reboot your 'mywebserver'.
Marvel at the now mysteriously functional ApplicationPoolIdentity.
Install MS HotFix KB2545850 and learn the details about this bug in KB2672809 which also shows the steps to reproduce and demonstrate this apparently random problem. Direct download link here.
Speculate why Microsoft has not managed to release a normal windows update for this in the 3 years since that hotfix was published. While people still continue running into it and pulling their hair out because of this obscure problem.
Learn about the other folks who have shared and enjoyed this gift from MS that still continues to keep on giving:
IIS application using application pool identity loses primary token?
DirectoryServicesCOMException 80072020 From IIS 7.5 Site Running Under ApplicationPoolIdentity
ApplicationPoolIdentity cannot access network resources
ApplicationPoolIdentity IIS 7.5 to SQL Server 2008 R2 not working
Windows Authentication Failed when using application pool identity
IIS 7.5 stops using machine account to connect to network resource when using AppPoolIdentity
Your Windows 7 dev machine probably worked fine because it reboots more often than the server. Congrats on your very well written and thorough bug report. I rarely see that here.
I had similar problem accessing a network share using AppPoolIdentity in an ASP.NET application (access denied).
Using NetworkService account or other domain account worked but these were not the best solution.
I performed almost all the tests you did but finally found something that worked.
I figured out that the Network Service account was not used when accessing the shares, just like you did (i expected domain\machine$ account)
This worked for us:
On your IIS web site, go to Authentication and change the Anonymous Authentication item to "Application Pool Identity". It's by default set to "IUSR". This solved our problem.
Also maybe activating ASP.NET impersonation (still in Authentication menu) may help.
Thibault
I have faced same issue, I resolved by creating one domain account for each environemt (QA, STAGE, PRODUCTION). In Application pool identity I have set custom account and I used domain user for respective account. Now It gives me the ability to write and read the files from UNC Path.
I am using SP 2010.
I created a new site collection from central admin.
and it gave me "site created successfully"
when I visit the new site collection, I get below error:
Cannot connect to the configuration database
What are my options?
Go to services (Start --> Run --> Type services.msc) and start the service SQL Server(SHAREPOINT)
Its probably the app pool you are running your site collection under, have you got any other site collections in the same web application?
If not take a look at the permissions on the app pool for that web app
This problem came to me after a password expired in the AD and had to be updated.
When i changed the password i had to sync in to the ad and used this site: http://info.izzy.org/Blog/archive/2010/08/04/how-to-fix-an-out-of-sync-password-issue-in-sharepoint-2010.aspx
Then i found out that the problem was that SharePoint Timer Service wasnt running och the Front end server. So I had to do an iisreset on the front end server to get the Service to start, since the account using the service was the account with a new password. And then everything was back on track again!
in my case the problem was secondary replica of Always on Was Empty and does not have Config database
i have configured an always Solution and at start i connect sharepoint to alias via cliconfig.exe and alias was connecting to AG listener
fail over back to instance where Config db exists solved my problem
I have a WCF web service that is deployed at IIS.
Part of the web service is to validate the inputs using EntLib 4.1
For ex, the string values can be of specific length and so on.
In case of the validation being failed a fault exception is raised and the service is supposed to write the message in log file.
How do I go about creating the log file to a location that can be configured from a config file.
Basically how do we write messages from IIS (since the service is hosted at IIS, I am assuming that that will be the source!)
To write to the log file, make sure that the identity running your web application has write access to the log directory.
IIS7: You can find the identity in the IIS management console. Select the application pool that your web application is using. Click on Advanced Settings. In the properties window, look for the identity field. It may say Network Service. This is the account that needs write permission to your log output folder.
IIS6: Same as IIS7 except right click on the app pool and select properties. The properties window of IIS6 will have an Identity tab.
If you already have a log file in this directory, try deleting it and letting the framework create it.
Hope this helps.
Why not just write the warnings/error to the Event Log? It's easier to maintain than arbitrary log files and you can query them from other machines.
http://imar.spaanjaars.com/275/logging-errors-to-the-event-log-in-aspnet-applications
This website helped me with the same problem on IIS 7.5, where you have new Application Pool Identities: http://learn.iis.net/page.aspx/624/application-pool-identities/
Using the command line ICACLS test.txt /grant "IIS AppPool\<AppPoolName>":F on the log file or log folder worked for me.
Trying to set the permissions via the file/folder properties dialog failed, the AppPool identity was not accepted there.