Uploading files: Access to path denied - asp.net

I've given IUSR full control over the folder but when i upload files it gives me this error:
Access to the path 'C:\inetpub\wwwroot\vivaweb\usr_up_img\Desert.jpg' is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.UnauthorizedAccessException: Access to the path 'C:\inetpub\wwwroot\vivaweb\usr_up_img\Desert.jpg' is denied.
ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET access to a file, right-click the file in Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.
Source Error:
The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:
1. Add a "Debug=true" directive at the top of the file that generated the error. Example:
<%# Page Language="C#" Debug="true" %>
or:
2) Add the following section to the configuration file of your application:
<configuration>
<system.web>
<compilation debug="true"/>
</system.web>
</configuration>
Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.
Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.
Stack Trace:
[UnauthorizedAccessException: Access to the path 'C:\inetpub\wwwroot\vivaweb\usr_up_img\Desert.jpg' is denied.]
System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +7716783
System.IO.File.Delete(String path) +7577512
ASP.vivaweb_dwzupload_resizeaspnet_aspx.ResizeImage(String oldPathImage, String newPathImage, Int32 Width, Int32 Height, Int32 imgQuality, Boolean keep, Boolean isThumb) +217
ASP.vivaweb_dwzupload_resizeaspnet_aspx.Page_Load(Object sender, EventArgs e) +379
System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
System.Web.UI.Control.OnLoad(EventArgs e) +99
System.Web.UI.Control.LoadRecursive() +50
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627

It is clear your application is using "ASP.NET" user
So give permission to this user or simply give permission to user everyone

There are a few unanswered questions in this post that I'll have to make a few assumptions on. First, I have no idea how you have your site deployed and thus don't know what identity it's using. If you are running it directly through visual studio, depending on your version, it should be either using "ApplicationPoolIdenity" or "NetworkService".
If you are running your site through IIS, you can figure that out easily (and change it if you like). Just open up application pools under the IIS instance and you should see them in an "identity" column.
After that, you will need to make sure to give permissions the same as the identity used to your site. Get the root folder used to house the site and give it appropriate permissions. Right click the folder and go to Properties -> Security -> Edit. Add in the identity that your site is using and you should be done.
A final note, you may actually want to turn on the debug configuration setting in your web.config file if you are in a local/debugging environment. It will give more information to work with to solve your issue.

Related

IIS appwhen adding a binding. servername.domain.com/app works, but appname.domain.com/app doesn't

I have a server whose sole purpose is to host a prebuilt IIS app from a vendor.
The server has been built, IIS is working, and with everything installed, the app is accessible from http://servername.domain.com/app
I want to add an alternate URL, to be http://appname.domain.com/app, for ease of use and cleanliness.
I added the binding on both ports 80 and 443 with our site cert, using all unassigned IPs and none of the boxes ticked.
Despite changing nothing but the bindings, I'm getting the following error attempting to use the newly bound URL:
Value cannot be null.
Parameter name: source
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.ArgumentNullException: Value cannot be null.
Parameter name: source
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[ArgumentNullException: Value cannot be null.
Parameter name: source]
System.Linq.Enumerable.Where(IEnumerable`1 source, Func`2 predicate) +6466184
Xtraction.Web.Auth.Authenticate.HasSingleActiveProvider() +185
Xtraction.Web.Auth.Authenticate.Page_Load(Object sender, EventArgs e) +115
System.Web.UI.Control.OnLoad(EventArgs e) +106
Xtraction.Web.PageBase.OnLoad(EventArgs e) +17
System.Web.UI.Control.LoadRecursive() +68
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3785
Based on the error information you provided, the reason I retrieved is that your application pool is not set up to use a service account, which prevents you from logging into Xtraction.
You need to set the application pool to use the Windows service account:
Go to IIS Manager > Servers > Application Pools > Xtraction
Click the Advanced Settings link in the right pane
Go to the Identity section, if it's set to Network Service, then click the ellipsis on the right
Change to "Custom Account" and enter your service account - this must have dbowner (or at least db_datareader and db_datawriter)
permissions on the Xtraction database
Click OK and restart the application pool (or execute iisreset). You should now be able to log in to Xtraction
For more information, you can refer to this link.

IIS 8.5 Access to the path is denied

The program will upload a picture and saved it in a virtual directory folder. I encounter this error and I follow the suggestions as suggested in stackOverview and still cannot resolve the issues.
The message simply says the IIS 8.5 doesn't have permission to access to the folder and save a picture in that particular folder. So,I give full permission to the following roles
Everyone - Full Control
IUSR - Full Control
Network Service - Full Control
Users - Full Control
Guest - Full Control![enter image description here][1]
IIS_IUSR - FUll Control
ANONYMOUS LOGIN - Full Control
DefaultAppPool - Fullcontrol
It is confirmed that Anonymous Authentication is enabled and the specific user is IUSR.
![enter image description here][2]
The detail error message is as below. Any advise is greatly appreciated.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.UnauthorizedAccessException: Access to the path is denied.
ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via , the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.
To grant ASP.NET access to a file, right-click the file in File Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.
[UnauthorizedAccessException: Access to the path is denied.]
System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +13946990
System.IO.File.InternalMove(String sourceFileName, String destFileName, Boolean checkHost) +350
TakePicture.files_FileUploaded(Object sender, FileUploadedEventArgs e) in C:\Users\sam\Documents\Visual Studio 2013\Projects\TownCouncilMobile\ReportDefect2\TakePicture.aspx.vb:45
Telerik.Web.UI.RadAsyncUpload.RaisePostDataChangedEvent() +199
System.Web.UI.Page.RaiseChangedEvents() +333
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3572
It has been 3 days as I am still stuck in this problem.
Maybe this will help someone with the same problem. Change Identity for your app pool to LocalSystem.

ASP.NET - Accessing Active Directory from code behind page

I have made a web application, which reads/writes from/to Active Directory. In my web.config file there is
<identity impersonate="true"/>
and
<authentication mode="Windows"/>
When I display
System.Web.HttpContext.Current.User.Identity.Name
in some label, it shows mydomain\myusername, so I think impersonation works.
Now to the question. When I access the application on the server, where the IIS web server is running, everything works great. But when I access the web application from a remote PC, I get an exception (the label still shows "mydomain\myusername").
I have traced the problem down. In the code behind when I call
Forest currentForest = Forest.GetCurrentForest();
the variable currentForest knows its currentForest.Name, currentForest.RootDomain or currentForest.ForestMode, but any call to currentForest.Domains, currentForest.Sites or currentForest.GlobalCatalogs results in
System.DirectoryServices.ActiveDirectory.ActiveDirectoryOperationException.
Now I'm lost and don't know what to debug further. The account I'm using is member of Enterprise Admins (multi-domain forest). I have tried it on two different servers with different IIS versions (IIS 7.5 and IIS 6.0) with no luck.
And the thrown exception isn't of much help:
Exception Details: System.DirectoryServices.DirectoryServicesCOMException: An operations error occurred.
Source Error: An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
DirectoryServicesCOMException (0x80072020): An operations error occurred.
System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) +557
System.DirectoryServices.DirectoryEntry.Bind() +44
System.DirectoryServices.DirectoryEntry.get_AdsObject() +42
System.DirectoryServices.DirectorySearcher.FindAll(Boolean findMoreThanOne) +98
System.DirectoryServices.ActiveDirectory.ADSearcher.FindAll() +46
System.DirectoryServices.ActiveDirectory.Forest.GetDomains() +543
[ActiveDirectoryOperationException: An operations error occurred.]
System.DirectoryServices.ActiveDirectory.Forest.GetDomains() +512484
System.DirectoryServices.ActiveDirectory.Forest.get_Domains() +44
myWebApp.ASPpage.Button_Click(Object sender, EventArgs e) in C:\Documents and Settings\myUser\documents\visual studio\Projects\MyWebApp\MyWebApp\ASPPage.aspx.cs:158
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +115
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +140
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +29
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +2981
EDIT: If it is not obvious, I want to use currentForest.Domains to search the whole forest (all domains) for a user given by UPN name.
I found the answer to my question in one of "Related questions" on this page. The answer was in this topic: Why does DirectoryServicesCOMException occur querying Active Directory from a machine other than the web server?
I found, that it was exactly my case. After reading the suggested Microsoft article, I learned, that impersonating works only for local resources on the IIS server. To access network resources (SQL, Active Directory), I have to set "Trust this computer for delegation" in the computer object in Active Directory.
It was because the IIS always authenticate therefore System.Web.HttpContext.Current.User.Identity.Name showsmydomain\myusername; to verify that the impersonation works you could use:
System.Security.Principal.WindowsIdentity.GetCurrent().Name, also the System.Security.Principal.WindowsIdentity.GetCurrent(true) returns null when it is not impersonating.

Creating directories in medium trust environment?

I've got an ASP.NET Web Application running in a medium trust environment with a shared hosting provider. The following code causes a SecurityException to be thrown:
private void TestButton_Click(object sender, EventArgs e)
{
string directory = Server.MapPath("~/MyFolder/") + "_TestDirectory";
if (!Directory.Exists(directory))
Directory.CreateDirectory(directory);
}
The full text of the error is:
System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet)
at System.Security.CodeAccessPermission.Demand()
at System.IO.Directory.InternalCreateDirectory(String fullPath, String path, DirectorySecurity dirSecurity)
at System.IO.Directory.CreateDirectory(String path, DirectorySecurity directorySecurity)
at ASP.testcreatedirectory_aspx.TestButton_Click(Object sender, EventArgs e)
The action that failed was:
Demand
The type of the first permission that failed was:
System.Security.Permissions.FileIOPermission
The Zone of the assembly that failed was:
MyComputer
The folder where the subfolder is being created has full permissions, so I don't think that's the problem. This looks like something to do with running in a medium trust environment.
Is it normal for medium trust environments to disallow the creation of new directories (via the Directory.Create method), and/or is there any workaround for this?
As long as the path you are trying to access is under the Virtual Directory your application is in, you should be able to access it in Medium Trust. Are you sure your application identity has folder create permission?
http://msdn.microsoft.com/en-us/library/aa302425#c09618429_015
Edit: I might have read the doc above wrong. See this link as well, it appears you only have Read, Write, Append, and PathDiscovery permissions :(
FileIOPermission is restricted. This
means you can only access files in
your application's virtual directory
hierarchy. Your application is granted
Read, Write, Append, and PathDiscovery
permissions for your application's
virtual directory hierarchy.
http://msdn.microsoft.com/en-us/library/ff648344.aspx

EventLog permission failing in ASP.Net on Win7

I have an ASP.Net app .net 3.5 SP1, running in Win7 . During the login process, something within the ASP.Net login control is causing a write to the security log (this sounds acceptable to me) in the event log. The problem is that it seems the app doesn't have permission to do this. There error is:
Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.
Exception Details: System.Security.SecurityException: Request for the permission of type 'System.Diagnostics.EventLogPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
The stack trace doesn't show a single line of code from my application, its all in the framework.
The last 5 lines are:
System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet) +0
System.Security.CodeAccessPermission.Demand() +61
System.Diagnostics.EventLog..ctor(String logName, String machineName, String source) +125
System.Diagnostics.EventLog..ctor() +24
System.Diagnostics.EventLog.WriteEntry(String source, String message, EventLogEntryType type, Int32 eventID, Int16 category, Byte[] rawData) +52
This same app works fine on XP SP2. I've hunted around and can't find how to give permissions. I've tried running hte app pool as LocalSystem and ApplicationPoolIdentity.
Whats the easiest way to get this running? Its my local dev machine and I don't care if I open up security holes, as long as I don't have to modify code (ie I need the solution to be an INETMGR change or web.config or some local permissions, etc).
Thanks!
This link appears to discuss the issue you are having.
I am not sure about the differences between the default CAS (code access security) on XP vs. win 7, however the assembly writing to the event log (and all calling assemblies) must have EventLogPermission.
You can add the AllowPartiallyTrustedCallers attribute or sign the assembly with a strong name key.
If you are writing to the default Application log you need to provide permisson to the LocalSystem before using it inside app pool.
Open RegistryEdit and goto
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\eventlog\Application
RightClick over the Applicatuion and click permissions
If the user(LOCALSYSTEM) is not present in the list then Add and Allow full Control

Resources