Access Denied

[cpajoe2001]

I am having an issue and after searching around online for a day and half now and finding others with the same problem but yet no solution to my issue I am looking for help.

What i have is ServerA which is a webserver running Win2k3 with IIS6, my domain account is a local administrator on this machine. The web app I am running is trying to write a file to ServerB which is also a Win2k3 machine. On the folder of the machine I am writing to I have NTFS Full control permissions to both me and the domain account that the IIS App Pool is running as. The IIS App Pool isn't running as Network Services but as a domain account that has administrative rights on ServerA and Full Control on the folder on Server B.

Some background on the webApp, it is a ASP.net 2.0 web page using C#. I have a onclick event that calls a Class passing a String[] Servers and a string Event.



--------------------------------------------------------------------------------


public string WriteServersToTextFiles(string [] theServerNames, string theServerProdGroup)

{

//String for the location of the server.txt file

string thePath = "";

int i;

//Pass the patch group into the path

thePath = @"\\ServerB\TEST\" + theServerProdGroup + @"\servers.txt";

//Check to see if file already exists. If so, call function that makes a backup copy and renames it.

if (File.Exists(thePath))

{

changeFileName(theServerProdGroup);

}


// create a writer and open the file

TextWriter tw = new StreamWriter(thePath);

// Write server names to the file

for (i = 0; i < theServerNames.Length; i++)

{

tw.WriteLine(theServerNames.ToString());

}


// close the stream

tw.Close();

//Call method, and return a string which confirms file was written successfully, or returns an error stating otherwise

return confirmTextFilesWereWritten(theServerNames, theServerProdGroup);

private void changeFileName(string theServerProdGroup)

{

//Create DateTime object that stores current date and time

DateTime currentDate = DateTime.Now;

//

http://msdn2.microsoft.com/en-us/library/8kb3ddd4.aspx

string newFileName = currentDate.ToString("yyyyMMddHHmmss") + "_servers.txt";

//Change file name

File.Move(@"\\ServerB\TEST\" + theServerProdGroup +

@"\servers.txt", @"\\ServerB\TEST\" + theServerProdGroup + @"\" + newFileName);

}

}


--------------------------------------------------------------------------------


When I run this WebApp as Localhost from ServerA everything works like it should and is great, however when I run the WebApp from my WinXP machine and I click the button to generate the text files I get prompted to login to ServerA even though the file is being wrote to ServerB. In my web.config I do have impersonate set to true as I need to for security reasons. No matter what account I try to use I get the following error.



--------------------------------------------------------------------------------


Access to the path '\\ServerB\TEST\Dev2_2000-0400\servers.txt' is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.UnauthorizedAccessException: Access to the path '\\ServerB\TEST\Dev2_2000-0400\servers.txt' is denied.

ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.

To grant ASP.NET access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.

Source Error:

Line 72:
Line 73: // create a writer and open the file
Line 74: TextWriter tw = new StreamWriter(thePath);
Line 75:
Line 76: // Write server names to the file


Source File: c:\Inetpub\

http://wwwroot\WSIHarvester\App_Code\ServersTextFileWriter.cs

Line: 74

Stack Trace:

[UnauthorizedAccessException: Access to the path '\\ServerB\TEST\Dev2_2000-0400\servers.txt' is denied.]
System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +2013027
System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) +998
System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options) +115
System.IO.StreamWriter.CreateFile(String path, Boolean append) +58
System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize) +91
System.IO.StreamWriter..ctor(String path) +27
ServersTextFileWriter.WriteServersToTextFiles(String[] theServerNames, String theServerProdGroup) in c:\Inetpub\

http://wwwroot\WSIHarvester\App_Code\ServersTextFileWriter.cs:74

Generate_Patch_Group_Text_Files.getPatchGroups_Click(Object sender, EventArgs e) in c:\Inetpub\

http://wwwroot\WSIHarvester\Generate_Patch_Group_Text_Files.aspx.cs:72

System.Web.UI.WebControls.Button.OnClick(EventArgs e) +105
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +107
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +7
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +11
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5102






--------------------------------------------------------------------------------

Version Information: Microsoft .NET Framework Version:2.0.50727.42; ASP.NET Version:2.0.50727.42



--------------------------------------------------------------------------------




--------------------------------------------------------------------------------
When this happens the event log for ServerA has a Application Event of

Event Type: Information
Event Source: ASP.NET 2.0.50727.0
Event Category: Web Event
Event ID: 1314
Date: 1/11/2007
Time: 8:38:39 AM
User: N/A
Computer: ServerA
Description:
Event code: 4011
Event message: An unhandled access exception has occurred.
Event time: 1/11/2007 8:38:39 AM
Event time (UTC): 1/11/2007 1:38:39 PM
Event ID: 1313c5a9caa548e0a681ca9502a48d28
Event sequence: 136
Event occurrence: 1
Event detail code: 0

Application information:
Application domain: /LM/W3SVC/1/Root/WSIHarvester-1-128129961851916396
Trust level: Full
Application Virtual Path: /WSIHarvester
Application Path: C:\Inetpub\

http://wwwroot\WSIHarvester\

Machine name: ServerA

Process information:
Process ID: 2576
Process name: w3wp.exe
Account name: Domain\ASPuserAccount

Request information:
Request URL:

http://ServerA/WSIHarvester/SchemeCurrent.aspx

Request path: /WSIHarvester/SchemeCurrent.aspx
User host address: 192.168.14.96
User: Domain\MyUserName
Is authenticated: True
Authentication Type: Negotiate
Thread account name: Domain\ASPuserAccountASPuserAccount

Custom event details:

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

And Also Security Events of

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 576
Date: 1/11/2007
Time: 8:38:42 AM
User: Domain\MyUserName
Computer: ServerA
Description:
Special privileges assigned to new logon:
User Name: MyUserName
Domain: Domain
Logon ID: (0x0,0xE5170)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 1/11/2007
Time: 8:38:42 AM
User: Domain\MyUserName
Computer: ServerA
Description:
Successful Network Logon:
User Name: MyUserName
Domain: Domain
Logon ID: (0x0,0xE5170)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: MyWinXPMachine
Logon GUID: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.14.96
Source Port: 4762


For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

I am at my wits end on how to solve this Issue. Any Help would greatly be appreciated. Also if you need to know any more information feel free to ask.

 

[ca8msm]

What authentication method are you using? Do you have anonymous access enabled? What do the following produce (just have a check before you attempt to copy the file):

1) WindowsIdentity.GetCurrent().Name
2) User.Identity.Name




____________________________________________________________

Need help finding an answer?

Try the Search Facility or read FAQ222-2244 on how to get better results.

 

[SiriusBlackOp]

Not sure this will help... but it's the best I can think of.

In the task manager of the webserver, is the asp.net worker process (w3wp.exe) running as the Network Service user name? This should be the process that is actually doing the saving of your file, but I'm not sure how to change that or even if you want to.

Have you tried editing the share permissions of your shared directory on ServerB by granting the entire webserver computer full control permissions? This should allow anything from that computer to write to it. Granting this permission is possible here, but I'm not certain if it is a function only available via Active Directory or not.

Again, this advice may be like trying to fish a pond with no fish, but it's the best I can think of without sitting in front of the problem.


Senior Software Developer

http://www.scoutsft.com

 

[cpajoe2001]

Both return
Domain\MyUserName

 

[cpajoe2001]

The asp.net worker process (w3wp.exe)is running as my AppPool which is a domain account Domain\ASPuserAccount

 

[SiriusBlackOp]

Have you tried granting the computer (ServerA) full control to the shared directory on ServerB?

Senior Software Developer

http://www.scoutsft.com

 

[unclerico]

I'm going to chime in here even though I am an extreme novice with .Net technologies. I think the issue that you are having is with NTLM authentication and the double-hop issues that come into play when you have an n-tier application. If you look in ServerB's event viewer under the Security log, you will more than likely see a whole bunch of failure audits with the majority of them saying "Unknown username or bad password". Situations where you need to access resources on a remote machine will require you to use Kerberos for authentication. Look into Protocol transition, constrained delegation (if your domain is at 2003 domain functional level), or delegation (if your domain is not 2003 domain functional level). Google "Protocol Transition" and about 80 gazillion pages will come back. Configuring this can be confusing so if you have questions beyond what you read in the google results, I can try to walk you through it. Hope this helps.

 

[cpajoe2001]

There is nothing that appears in Server B's Eventlogs just Server A's But I too was wondering about a double hop issue I know there is a double hop issue with Active Directory but this too???