I recently changed the frontend of a project, to use windows authentication.
But i still want the backend to use forms authentication, I think i read somewhere that it was not possible to use both authentication methods at the same time. But I seem to have it working, sort of.
I'm using umbraco v4.7.2 - To those that doesn't know this CMS, it's basicly just like any other CMS, the backend of the application is the umbraco "backoffice", basicly just an application hidden away in a folder called "~/umbraco/"
This folder has a custom membership provider configured in the web.config.
The frontend site authenticates users automaticly using windows authentication with a role/group restriction. And this is pretty fast, no problems there.
But when i try to access the umbraco folder, which is configured to enable anonymous access, IIS just hangs for at least a minute, before sending me to the login page.
And after the initial hang, i am able to browse the backend fine, but if i leave the backend, and go to the frontend of the application, and then back to the backend, i get the same hanging again. etc.
I tried debugging the code from visual studio, but all i get is some obscure disassembly, which i am unable to make any sense of.
EDIT: This is very odd, as requesting the folder "umbraco" is very slow, but after waiting and being redirected to "umbraco/login.aspx", refreshing this page, or any other page in umbraco is not slow at all. But requesting the folder "umbraco/" is still very slow.
Fiddler
ServerGotRequest: 10:09:21.352
ServerBeginResponse: 10:11:11.961
GotResponseHeaders: 10:11:11.961
ServerDoneResponse: 10:11:11.961
After the ServerGotRequest, something is making IIS hang.
I will try and create another folder with the same configuration, and see if this also happens then.
Has anyone got any clues to what might cause this?
Thanks :)
Related
I have an asp.net mvc 3 app installed on IIS6 and I am getting ACL errors (401.3 errors) when trying to access it. It is running as a virtual app under the default web. I have gone through what I believe are the correct security setting on the respective folders.
I have given the Network Service and in IUSER_ users access to the root folder of the default web. I have also given access to the microsoft.net, temp and system32 folders under c:\windows.
I still get the 401.3 error. When I set the app to use both anonymous and windows authentication I get prompted for credentials. Entering the credentials allows me to access the app. This means that there is some file/folder that needs permissions.
So I used FileMon to see what was going on. I hit the site and get the ACL error but I see no ACCESS DENIED errors in FileMon nor so I see any reference to the site itself. It is like I never made a request. (Yes I cleared my cache).
I am tapped out on what to do next. Any suggestions on where to look to determine what resources needs permissions?
Thanks in advance!
In order for MVC to work on IIS6, you need to do some configuration changes in IIS. Specifically, you should tell IIS to handle all request, in order to ensure that the .NET routing engine kicks in.
http://haacked.com/archive/2010/12/21/asp-net-mvc-3-extensionless-urls-on-iis-6.aspx/
This is one of the best tutorials on getting MVC to work with IIS6.
We have an old ASP.NET application hosted in IIS6/Win2k3. It's a document generation application that uploads the documents to SharePoint 2003. The application uses an application pool under the user sharepointservice, which is the administrator of the SharePoint site. The web application, which has been recently migrated to .net 2.0 from 1.1, uses NTLM authentication to identify our intranet users.
As the IT administrators are on holidays, I, the developer, has been given local admin rights to the Win2k3 box. The issue is, whenever I deploy the website, though the documents are uploaded appropriately to the SharePoint site via the application, the users are not able to download them. The error is
HTTP Error 403 - Forbidden: Access is denied
I know the IT guys use a service account, not their domain user accounts.
I have already tried to modify the permissions in IIS for that website. I even put Everyone and <Domain>\Users to have read access to all of those folders, to no avail. I've scoured the net, there are no definitive answers. Am I missing something else?
I hate answering my own question, but this did it for me:
The application pools for the SharePoint site were modified from the default. So I reset them, including the AppPools for _layouts, _vti_bin, and _wpresources. Their AppPools are now the default, and are the same.
This link gave me the lead.
You are probably being prompted by permissions for the file system. Check the directories where IO is happening and make sure the user sharepointservice is using in the app pool has read/write permissions.
I just had this problem and solved it after following these instructions:
http://support.microsoft.com/kb/2543306
It seems the webapplication took so long that it hadn't created everything correctly when the IIS timed out. So I was receiving strange errors like yours.
From Flex we call a Upload.aspx page which is configured for anonymous authentication. Most of the time, it works like a charm, but once in a while, the browser does prompt a enter credentials popup...
The whole site is configured for Windows Authentication, but some pages and folders are set to use anonymous authentication. This is done using the location tag in web.config.
What could be the reason for this?
UPDATE:
Only happening in Internet Explorer... they should deport it.
If you use FireFox with FireBug, open up the Net panel, it will show you the request making the permissions request. If you cancel it, it will show an access denied in red, and that will easily help you hunt the issue down.
Maybe it's because a file (image, css, etc.) is being referenced that doesn't exist?
A couple of things I would check out:
Are there any images/other files that are added to your page using the FQDN? If so, are any of these pointing to an external site or staging site that might require credentials?
Is it possible that someone has removed permissions from the application pool credentials on the web server for some specific file or files the site is requesting?
Is the site load balanced or part of a farm? It could be that one or many servers are configured incorrectly, and the rest are ok. Then if by chance you hit the bad servers, you could get the prompt.
I am trying to get a grasp on how to handle updates to a live, functioning ASP.NET (2.0 or greater) Application while there are users on the site.
For example, suppose SO is an ASP.NET Web Application project. The project code compiles down to the single .DLL in the BIN folder. Now, there are constantly users on SO, so what would happen to users' actions/sessions if you would use the Visual Studio .NET "Publish" feature (or just FTP everything again manually) while they are using the site?
Would creating an ASP.NET Web Site, instead, alleviate any problems that may or may not exist with the scenario above? I am beginning to develop a web site as a user-driven Web Application, and I want to make sure that my inexperience with this would not potentially annoy the [potentially] many users that I [want to] have 24/7.
EDIT: Sorry, I should have put this in a more exact context. Assume that this site is being hosted by a web hosting service with monthly fees. I won't be managing the server itself, just what the web host allows as a user of their services.
I create two Web sites in IIS. One is the production Web site, and the other is a static Web site with an HttpHandler that sends all requests to a single static "We're updating" HTML page served with an HTTP 503 Service Unavailable. Typically the update Web site is turned off. When it's time to update, we stop the production Web site, start the update Web site, and now we can fiddle with the production Web site all we want without worrying about DLLs being locked or worker processes needing to be spun down.
I started doing this because
App_Offline.htm really does not work well in Web Gardens, which we use.
App_Offline.htm serves its page as 404, which is bad if you're down for a meaningful period of time.
We can start the upgraded production Web site with modified settings (only listening on localhost), where we can do a last-minute acceptance/verification that everything is working before we flip the switch, turning off the update Web site and re-enabling the production Web site.
Things this does not solve include
Any maintenance that requires a restart of the server--you still have downtime where no page is served.
Any maintenance that diddles with the .NET runtime, like upgrading to the latest service pack.
Other approaches I've seen include
Having two servers. Send all load balancing requests to one server, upgrade the other one; then rinse and repeat. Most of us don't have this luxury.
Creating multiple bin directories, like bin-1.0.0.0 and bin-1.1.0.0 and telling ASP.NET which bin directory to use in the web.config file. (One advantage of this is that reverting to a previous binary is just editing a config file. A disadvantage is that it's harder to revert resources that don't end up in your binaries, like templates and images and such.) I don't remember how this actually worked--I think the application did some late assembly loading in its Global.asax based on its own web.config section (since you touched the web.config, the app had restarted, so it was okay).
If you find a better way, let me know!
Changing to the asp.net web site model won't have any effect, as the recycle will also happen, some of changes that trigger it for sure: web.config, global.asax, app_code.
After the recycle, user will still be logged in because asp.net will just validate the syntax. That is given you use a fixed machine key, otherwise it will change on each recycle. This is something you want to do anyway as other stuff can break if the key change across requests i.e. viewstate validation, embedded resources (decryption of the url fails).
If you can put the session out of process, like in sql server, you will avoid loosing the session. If you can't, your code will have to consider that. There are plenty of scenarios where you can avoid using session, and others were you can wrap it and re-retrieve the info if the session was cleaned. This should leave you with a handful specific cases that you know can give trouble to the users, so for those you do some of the suggestions others have already made.
One solution could be to deploy your application into a load balanced environment (web farm).
When deploying a new version you would use the load balancer to redirect requests to the server you are not deploying to.
App_offline.htm is great solution for this I think.
in SO we see application currently unavailable page when a deployment begins.
I am not sure how SO handles it.. But we usually put a holding page. So what ever the user has done (adding question or answering questions) does not get updated. As soon as he updates something he will see a holding page asking him to try after sometime.
And if I am the user I usually press the back button to make sure what I entered is saved in the browser history so that I can post later.
Some site use use are in clustered environment so I take one server offline and inform the load balancer that she will not be available and once I make sure that the new version is working fine I make it live.. I do the same thing for the next server.
Do we have any other option?
It is not a technical solution, but set up a scheduled maintenance window. You can annoucement in advance giving your user base fair warning that there is a possiblity that the application will not be available during that time frame.
I have code running in an ascx within PageLayout within SharePoint 2007 that accesses files on a remote server i.e. File.Create("\servername\sharename\folder\file.txt"). The code runs within a SharePoint web application that has CAS trust set to Full in the web.config. The File.Create throws the following exception:-
System.UnauthorizedAccessException
Access to the path '\\servername\sharename\folder\file.txt' is denied.
The share is shared to Everyone with Full Control and the NTFS permissions are set to Everyone with Full Control. The web application app pool is running under a domain account also with explicit permissions to access that resource (not that this should be needed).
I ran Process Monitor on the remote machine and no hits were being recorded on the server. This leads me to believe that it is an issue with the SharePoint Code Access Security settings. Like I've said above, the trust in the web.config is set to Full.
Is it possible that CAS is still blocking the remote access? Can anyone think of any other area to review?
Update
A bit more information...
I've tried making the app pool acct domain admin and the problem still occurs. When using the same method to access a drive on the local machine it works fine. Running the same code in SnippetCompiler outside of sharepoint using the app pool account works fine.
Hope this helps, let me know if you can think of any more avenues of investigation or tests I can try.
Update
Im not sure if this would affect the issue but the local server is running Windows Server 2003 and the remote server is running Windows 2000.
Update
I've just tried running the code through a web part and it works fine. The file structure I use in the project that is failing is as follows:-
wss
- VirtualDirectories
- SharePointWebApp
- ...sp web app files
- .
- .
- PageLayoutControls
- control.ascx
- .
- .
Then in IIS I have the following structure:-
IIS
- Websites
- SharePointWebApp (pointing to \wss\VirtualDirectories\SharePointWebApp)
- PageLayoutControls (virtual directory pointing to \wss\VirtualDirectories\PageLayoutControls)
Then within the PageLayouts I reference the controls using the following:-
<%# Register TagPrefix="TEST" TagName="MyControl" Src="~/PageLayoutControls/control.ascx" %>
<asp:Content ContentPlaceholderID="PlaceHolderMain" runat="server">
<TEST:MyControl id="myControl" runat="server"/>
</asp:Content>Let me know if you need more info.
Update
The mystery deepens...
When I access the sharepoint site from Internet Explorer (6 or 7) on the SharePoint web front end server I do NOT get the exception.
When I access the sharepoint site from Mozilla Firefox from the SP web front end server I DO get the exception.
When I access the sharepoint site remotely from ANY browser I get the exception.
Also, it makes no difference what user I use to log on to the site, as long as they have permissions to access the sharepoint site.
Any thoughts?
Update
Hmm, I've now found that if I access the sharepoint site remotely and the sharepoint site tries to do a File.Create() locally (i.e. File.Create("C:\temp\abc.txt")) then it works. If I access the sharepoint site from the sharepoint box and do a File.Create() remotely (i.e. File.Create("\ServerName\ShareName\FolderName\file.txt")) then it works.
It only fails when I access the sharepoint site remotely and have the sharepoint site try to do a File.Create() remotely as well. Kind of a double hop problem. This makes me think it may be an NTLM / Kerberos issue.
Currently, we are running using NTLM authentication.
Has anyone else experienced this sort of issue?
Update
Yep, I'm pretty sure this is an NTLM issue not allowing a double hop. I just changed the authentication on the sharepoint site to use Basic Authentication and its worked. Changed it back to Integrated Authentication and it failed.
Now to decide whether to move the farm to use Kerberos or find another way around the issue. :-/
Update
Just giving SPSecurity.RunWithElevatedPrivileges a shot now. One thing though, is RunWithElevatedPrivileges meant to be used in this context? Previously, I've only used it to get access to lists and libraries within SharePoint rather than accessing a file access the network.
Any thoughts?
Update
Yep, SPSecurity.RunWithElevatedPrivileges resolves the issue. :-)
I wonder if this is the double-hop issue and that your code is trying to access the resource as the impersonated user, but that fails because NTLM will not impersonate to another server (Kerberos would).
Have you tried SPSecurity.RunWithElevatedPrivileges? That would remove the impersonation (RevertToSelf) and then maybe the application pool owner can just act as himself (herself?) whereas maybe it couldn't before.
Just a thought and should be pretty easy to try out.