Need help on a Web security thing

[Jayme Pechan]

I wrote a very simply web application and I'm having all sorts of problems
with the security getting in the way. All the web application does is load
an out-of-process COM server that is running as a service. The code is here
written for both a WinForm C# application (which works correctly) and a Web
application (which does not work correctly):

// C# application
xtapisvrLib.Xta piConfig x = new xtapisvrLib.Xta piConfigClass() ;

txtConfig.Text = x.GetConfigurat ion();

// WEB APPLICATION

xtapisvrLib.Xta piConfig xc = new xtapisvrLib.Xta piConfigClass() ;

TextBox1.Text = xc.GetConfigura tion();

I get an exception : System.Unautori zedAccessExcept ion: Access is denied.

So as an attempted to simply get this working, I added the IUSR_CDTBTL1F6
user and the ASPNET user to the administrator account with no effect.

My authorization section in my Web.Config looks like this:

<authenticati on mode="None" />

<authorizatio n>

<allow users="*" />

</authorization>

This Web Application works fine on my Windows XP development machine but if
I try to put it on my Windows 2000 test machine, it gives me the exception.
Anyone have any ideas where I can go from here? I know of no other security
mechnism for a Web Application to access a local COM object.

Thanks

[Jayme Pechan]

I ran File Monitor on the machine and reproduced the error in the browser
but I saw no failure type result but still got the error message. Hmmm.
This seems very odd to me.

"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:uD******** ******@TK2MSFTN GP10.phx.gbl...

I wrote a very simply web application and I'm having all sorts of problems
with the security getting in the way. All the web application does is load an out-of-process COM server that is running as a service. The code is here written for both a WinForm C# application (which works correctly) and a Web application (which does not work correctly):

// C# application
xtapisvrLib.Xta piConfig x = new xtapisvrLib.Xta piConfigClass() ;

txtConfig.Text = x.GetConfigurat ion();

// WEB APPLICATION

xtapisvrLib.Xta piConfig xc = new xtapisvrLib.Xta piConfigClass() ;

TextBox1.Text = xc.GetConfigura tion();

I get an exception : System.Unautori zedAccessExcept ion: Access is denied.

So as an attempted to simply get this working, I added the IUSR_CDTBTL1F6
user and the ASPNET user to the administrator account with no effect.

My authorization section in my Web.Config looks like this:

<authenticati on mode="None" />

<authorizatio n>

<allow users="*" />

</authorization>

This Web Application works fine on my Windows XP development machine but if I try to put it on my Windows 2000 test machine, it gives me the exception. Anyone have any ideas where I can go from here? I know of no other security mechnism for a Web Application to access a local COM object.

Thanks

[Scott Allen]

You gave permissions to a couple users, but what identity does the COM
server run with?

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Mon, 6 Dec 2004 12:50:19 -0800, "Jayme Pechan"
<ja**********@w hitefeld.com> wrote:

I wrote a very simply web application and I'm having all sorts of problems
with the security getting in the way. All the web application does is load
an out-of-process COM server that is running as a service. The code is here
written for both a WinForm C# application (which works correctly) and a Web
application (which does not work correctly):

// C# application
xtapisvrLib.Xt apiConfig x = new xtapisvrLib.Xta piConfigClass() ;

txtConfig.Te xt = x.GetConfigurat ion();

// WEB APPLICATION

xtapisvrLib.Xt apiConfig xc = new xtapisvrLib.Xta piConfigClass() ;

TextBox1.Tex t = xc.GetConfigura tion();

I get an exception : System.Unautori zedAccessExcept ion: Access is denied.

So as an attempted to simply get this working, I added the IUSR_CDTBTL1F6
user and the ASPNET user to the administrator account with no effect.

My authorization section in my Web.Config looks like this:

<authenticatio n mode="None" />

<authorization >

<allow users="*" />

</authorization>

This Web Application works fine on my Windows XP development machine but if
I try to put it on my Windows 2000 test machine, it gives me the exception.
Anyone have any ideas where I can go from here? I know of no other security
mechnism for a Web Application to access a local COM object.

Thanks

[Willy Denoyette [MVP]]

You need to set your DCOM permissions using DCOMCNFG.EXE

Willy.

"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:uD******** ******@TK2MSFTN GP10.phx.gbl...

I wrote a very simply web application and I'm having all sorts of problems
with the security getting in the way. All the web application does is
load
an out-of-process COM server that is running as a service. The code is
here
written for both a WinForm C# application (which works correctly) and a
Web
application (which does not work correctly):

// C# application
xtapisvrLib.Xta piConfig x = new xtapisvrLib.Xta piConfigClass() ;

txtConfig.Text = x.GetConfigurat ion();

// WEB APPLICATION

xtapisvrLib.Xta piConfig xc = new xtapisvrLib.Xta piConfigClass() ;

TextBox1.Text = xc.GetConfigura tion();

I get an exception : System.Unautori zedAccessExcept ion: Access is denied.

So as an attempted to simply get this working, I added the IUSR_CDTBTL1F6
user and the ASPNET user to the administrator account with no effect.

My authorization section in my Web.Config looks like this:

<authenticati on mode="None" />

<authorizatio n>

<allow users="*" />

</authorization>

This Web Application works fine on my Windows XP development machine but
if
I try to put it on my Windows 2000 test machine, it gives me the
exception.
Anyone have any ideas where I can go from here? I know of no other
security
mechnism for a Web Application to access a local COM object.

Thanks

[Jayme Pechan]

The COM server runs as a service under the system account.
"Scott Allen" <bitmask@[nospam].fred.net> wrote in message
news:ri******** *************** *********@4ax.c om...

You gave permissions to a couple users, but what identity does the COM
server run with?

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Mon, 6 Dec 2004 12:50:19 -0800, "Jayme Pechan"
<ja**********@w hitefeld.com> wrote:

I wrote a very simply web application and I'm having all sorts of problemswith the security getting in the way. All the web application does is loadan out-of-process COM server that is running as a service. The code is herewritten for both a WinForm C# application (which works correctly) and a Webapplication (which does not work correctly):

// C# application
xtapisvrLib.Xt apiConfig x = new xtapisvrLib.Xta piConfigClass() ;

txtConfig.Te xt = x.GetConfigurat ion();

// WEB APPLICATION

xtapisvrLib.Xt apiConfig xc = new xtapisvrLib.Xta piConfigClass() ;

TextBox1.Tex t = xc.GetConfigura tion();

I get an exception : System.Unautori zedAccessExcept ion: Access is denied.

So as an attempted to simply get this working, I added the IUSR_CDTBTL1F6
user and the ASPNET user to the administrator account with no effect.

My authorization section in my Web.Config looks like this:

<authenticatio n mode="None" />

<authorization >

<allow users="*" />

</authorization>

This Web Application works fine on my Windows XP development machine but ifI try to put it on my Windows 2000 test machine, it gives me the exception.Anyone have any ideas where I can go from here? I know of no other securitymechnism for a Web Application to access a local COM object.

Thanks

[Jayme Pechan]

I'm not sure why it would require DCOM permissions since I am only accessing
it locally as a COM object but I went ahead and did it anyway. It still had
no affect. I continue to get the same error.

I set the Authentication Level to "None"
Set custom access permissions to add ASPNET and IUSR_CDTBTL1F6 with Allow
Access
Set custom launch permissions to add ASPNET and IUSR_CDTBTL1F6 with Allow
Launch
Set custom config permissions to add ASPNET and IUSR_CDTBTL1F6 with Full
Control

I don't really want DCOM access to this object but it doesn't seem to help
anyway.

"Willy Denoyette [MVP]" <wi************ *@pandora.be> wrote in message
news:eP******** ******@TK2MSFTN GP11.phx.gbl...

You need to set your DCOM permissions using DCOMCNFG.EXE

Willy.

"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:uD******** ******@TK2MSFTN GP10.phx.gbl...

I wrote a very simply web application and I'm having all sorts of problems with the security getting in the way. All the web application does is
load
an out-of-process COM server that is running as a service. The code is
here
written for both a WinForm C# application (which works correctly) and a
Web
application (which does not work correctly):

// C# application
xtapisvrLib.Xta piConfig x = new xtapisvrLib.Xta piConfigClass() ;

txtConfig.Text = x.GetConfigurat ion();

// WEB APPLICATION

xtapisvrLib.Xta piConfig xc = new xtapisvrLib.Xta piConfigClass() ;

TextBox1.Text = xc.GetConfigura tion();

I get an exception : System.Unautori zedAccessExcept ion: Access is denied.
So as an attempted to simply get this working, I added the IUSR_CDTBTL1F6 user and the ASPNET user to the administrator account with no effect.

My authorization section in my Web.Config looks like this:

<authenticati on mode="None" />

<authorizatio n>

<allow users="*" />

</authorization>

This Web Application works fine on my Windows XP development machine but
if
I try to put it on my Windows 2000 test machine, it gives me the
exception.
Anyone have any ideas where I can go from here? I know of no other
security
mechnism for a Web Application to access a local COM object.

Thanks

[Willy Denoyette [MVP]]

The identity of the server doesn't matter. You have to change the security
access permissions for your "DCOM server" by running dcomcnfg.exe (check
component services - DCOM config - yourserver - properties - security-
access permissions - add .. ASPNET).

Willy.
"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:OV******** ******@TK2MSFTN GP09.phx.gbl...

The COM server runs as a service under the system account.
"Scott Allen" <bitmask@[nospam].fred.net> wrote in message
news:ri******** *************** *********@4ax.c om...

You gave permissions to a couple users, but what identity does the COM
server run with?

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Mon, 6 Dec 2004 12:50:19 -0800, "Jayme Pechan"
<ja**********@w hitefeld.com> wrote:

>I wrote a very simply web application and I'm having all sorts of problems >with the security getting in the way. All the web application does is load >an out-of-process COM server that is running as a service. The code is here >written for both a WinForm C# application (which works correctly) and a Web >application (which does not work correctly):
>
>// C# application
>xtapisvrLib.Xt apiConfig x = new xtapisvrLib.Xta piConfigClass() ;
>
>txtConfig.Te xt = x.GetConfigurat ion();
>
>
>
>// WEB APPLICATION
>
>xtapisvrLib.Xt apiConfig xc = new xtapisvrLib.Xta piConfigClass() ;
>
>TextBox1.Tex t = xc.GetConfigura tion();
>
>
>
>I get an exception : System.Unautori zedAccessExcept ion: Access is
>denied.
>
>So as an attempted to simply get this working, I added the
>IUSR_CDTBTL1 F6
>user and the ASPNET user to the administrator account with no effect.
>
>My authorization section in my Web.Config looks like this:
>
><authenticatio n mode="None" />
>
><authorization >
>
> <allow users="*" />
>
></authorization>
>
>
>
>This Web Application works fine on my Windows XP development machine but if >I try to put it on my Windows 2000 test machine, it gives me the exception. >Anyone have any ideas where I can go from here? I know of no other security >mechnism for a Web Application to access a local COM object.
>
>Thanks
>
>
>

[Willy Denoyette [MVP]]

"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:et******** ******@TK2MSFTN GP14.phx.gbl...

I'm not sure why it would require DCOM permissions since I am only
accessing
it locally as a COM object but I went ahead and did it anyway. It still
had
no affect. I continue to get the same error.

I set the Authentication Level to "None"
Set custom access permissions to add ASPNET and IUSR_CDTBTL1F6 with Allow
Access
Set custom launch permissions to add ASPNET and IUSR_CDTBTL1F6 with Allow
Launch
Set custom config permissions to add ASPNET and IUSR_CDTBTL1F6 with Full
Control

I don't really want DCOM access to this object but it doesn't seem to help
anyway.

It's an "out of process server" so you are using DCOM right? You don't need
to give launch permissions as the process is launched as a service, not by a
DCOM instance creation request, the same for config permissions, aspnet and
IUSR_XXXX are no interactive user accounts so they can configure DCOM
annyway.
Did you restart your service, after you changed the permissions?

Willy.

[Jayme Pechan]

Ok, I think I have the right combination. There are settings in the server
that have to be set in addition to the DCOMCNFG program. My question now
is, is there anyway to set these permissions with an installer or must I
instruct the user how to run DCOMCNFG and make the changes? That seems
pretty bad so I'm hoping for an alternative. btw, thanks for the DCOM
suggestion. I don't quite understand why it needs right through DCOM but it
does help.
"Willy Denoyette [MVP]" <wi************ *@pandora.be> wrote in message
news:%2******** ********@TK2MSF TNGP12.phx.gbl. ..

"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:et******** ******@TK2MSFTN GP14.phx.gbl...

I'm not sure why it would require DCOM permissions since I am only
accessing
it locally as a COM object but I went ahead and did it anyway. It still
had
no affect. I continue to get the same error.

I set the Authentication Level to "None"
Set custom access permissions to add ASPNET and IUSR_CDTBTL1F6 with Allow Access
Set custom launch permissions to add ASPNET and IUSR_CDTBTL1F6 with Allow Launch
Set custom config permissions to add ASPNET and IUSR_CDTBTL1F6 with Full
Control

I don't really want DCOM access to this object but it doesn't seem to help anyway.

It's an "out of process server" so you are using DCOM right? You don't

need to give launch permissions as the process is launched as a service, not by a DCOM instance creation request, the same for config permissions, aspnet and IUSR_XXXX are no interactive user accounts so they can configure DCOM
annyway.
Did you restart your service, after you changed the permissions?

Willy.

[Willy Denoyette [MVP]]

"Jayme Pechan" <ja**********@w hitefeld.com> wrote in message
news:eI******** ********@TK2MSF TNGP15.phx.gbl. ..

Ok, I think I have the right combination. There are settings in the
server
that have to be set in addition to the DCOMCNFG program. My question now
is, is there anyway to set these permissions with an installer or must I
instruct the user how to run DCOMCNFG and make the changes? That seems
pretty bad so I'm hoping for an alternative. btw, thanks for the DCOM
suggestion. I don't quite understand why it needs right through DCOM but
it
does help.

Out-of-process COM servers use ORPC as IPC protocol (commonly called DCOM)
and security is an integral part of it. Normally you should configure COM
security programatically in your server code, if you don't, you can set it
in the registry chech this: "Setting Processwide Security Through the
Registry in MSDN".
However, If you don't need security at all why didn't you implement the
server using remoting instead of DCOM? Or better why didn't you use
System.Enterpri seServices (COM+) to host your out-proc server, here you
could use the administrative facilities of COM+ to configure the security
settings.
Willy.