webservice permissions

[Daniel Wilson]

I have a client who is trying to deploy a webservice I wrote. The web
service reads a file on a file server and delivers information about it. The
file needs to be inaccessible to the user of the webservice because it is
intellectual property.

This sounds easy. Just give the IUsr account on the web server, a 2003
server running IIS6, read rights to the files on the file server. Since no
HTTP path will get to the file server, the user can't steal the file.

Unfortunately, the service returns the error
Access to the path "\\FS1\Share\De signs\" is denied.

The Everyone group has rights to the share as well as the Designs folder.
But this happens.

I suggested running the virtual directory under which the web service ran
under a domain account, not the local IUSR. The client reported that the
webservice page would not load at all under that configuration.

What are we doing wrong?

Thanks.
--
Daniel Wilson
Senior Software Solutions Developer
Embtrak Development Team
http://www.Embtrak.com
DVBrown Company

[Ken Schaefer]

a) IUSR_<machinena me> is a *local* account. You can't assign it permissions
to remote resources

b) If this is a .NET app, then your code probably isn't running under
IUSR_<machinena me> anyway, but rather the process identity for the worker
process (w3wp.exe) that's services your web app

c) If you want to use a custom account for a web app pool identity, then
place that account into the IIS_WPG group on the IIS server (at the very
least), so that it has the necessary permissions to run. If that still
doesn't work, consult this KB article here, to see if anything else is
missing: http://support.microsoft.com/?kbid=812614

Hope that helps

Cheers
Ken

"Daniel Wilson" <d.******@embtr ak.com> wrote in message
news:ew******** ******@tk2msftn gp13.phx.gbl...

I have a client who is trying to deploy a webservice I wrote. The web
service reads a file on a file server and delivers information about it.
The
file needs to be inaccessible to the user of the webservice because it is
intellectual property.

This sounds easy. Just give the IUsr account on the web server, a 2003
server running IIS6, read rights to the files on the file server. Since no
HTTP path will get to the file server, the user can't steal the file.

Unfortunately, the service returns the error
Access to the path "\\FS1\Share\De signs\" is denied.

The Everyone group has rights to the share as well as the Designs folder.
But this happens.

I suggested running the virtual directory under which the web service ran
under a domain account, not the local IUSR. The client reported that the
webservice page would not load at all under that configuration.

What are we doing wrong?

Thanks.
--
Daniel Wilson
Senior Software Solutions Developer
Embtrak Development Team
http://www.Embtrak.com
DVBrown Company

[Daniel Wilson]

Thanks for the suggestions. They've tried those ideas today ... to no
avail.

Any more ideas?

Thanks.

dwilson
"Ken Schaefer" <ke*******@THIS adopenstatic.co m> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..

a) IUSR_<machinena me> is a *local* account. You can't assign it permissions to remote resources

b) If this is a .NET app, then your code probably isn't running under
IUSR_<machinena me> anyway, but rather the process identity for the worker
process (w3wp.exe) that's services your web app

c) If you want to use a custom account for a web app pool identity, then
place that account into the IIS_WPG group on the IIS server (at the very
least), so that it has the necessary permissions to run. If that still
doesn't work, consult this KB article here, to see if anything else is
missing: http://support.microsoft.com/?kbid=812614

Hope that helps

Cheers
Ken

"Daniel Wilson" <d.******@embtr ak.com> wrote in message
news:ew******** ******@tk2msftn gp13.phx.gbl...

I have a client who is trying to deploy a webservice I wrote. The web
service reads a file on a file server and delivers information about it.
The
file needs to be inaccessible to the user of the webservice because it is intellectual property.

This sounds easy. Just give the IUsr account on the web server, a 2003
server running IIS6, read rights to the files on the file server. Since no HTTP path will get to the file server, the user can't steal the file.

Unfortunately, the service returns the error
Access to the path "\\FS1\Share\De signs\" is denied.

The Everyone group has rights to the share as well as the Designs folder. But this happens.

I suggested running the virtual directory under which the web service ran under a domain account, not the local IUSR. The client reported that the webservice page would not load at all under that configuration.

What are we doing wrong?

Thanks.
--
Daniel Wilson
Senior Software Solutions Developer
Embtrak Development Team
http://www.Embtrak.com
DVBrown Company

[SQLScott]

Daniel,

You need pass credentials to the web service that have access to the share.
For example:

ws = New csiaigws.csiaig hooks

Dim cache As New CredentialCache

cache.Add(New Uri("http://localhost/CSIAIGWS/"), "negotiate" , New
NetworkCredenti al("domainuser" , "password", "domain"))

ws.Credentials = cache

The credentials that you use in the Cache.Add this way you don't have to
mess with IUSR or anything else.

Let me know if you have any questions about this. HOpe this helps...

Scott
"Daniel Wilson" wrote:

Thanks for the suggestions. They've tried those ideas today ... to no
avail.

Any more ideas?

Thanks.

dwilson
"Ken Schaefer" <ke*******@THIS adopenstatic.co m> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..

a) IUSR_<machinena me> is a *local* account. You can't assign it

permissions

to remote resources

b) If this is a .NET app, then your code probably isn't running under
IUSR_<machinena me> anyway, but rather the process identity for the worker
process (w3wp.exe) that's services your web app

c) If you want to use a custom account for a web app pool identity, then
place that account into the IIS_WPG group on the IIS server (at the very
least), so that it has the necessary permissions to run. If that still
doesn't work, consult this KB article here, to see if anything else is
missing: http://support.microsoft.com/?kbid=812614

Hope that helps

Cheers
Ken

"Daniel Wilson" <d.******@embtr ak.com> wrote in message
news:ew******** ******@tk2msftn gp13.phx.gbl...

I have a client who is trying to deploy a webservice I wrote. The web
service reads a file on a file server and delivers information about it.
The
file needs to be inaccessible to the user of the webservice because it is intellectual property.

This sounds easy. Just give the IUsr account on the web server, a 2003
server running IIS6, read rights to the files on the file server. Since no HTTP path will get to the file server, the user can't steal the file.

Unfortunately, the service returns the error
Access to the path "\\FS1\Share\De signs\" is denied.

The Everyone group has rights to the share as well as the Designs folder. But this happens.

I suggested running the virtual directory under which the web service ran under a domain account, not the local IUSR. The client reported that the webservice page would not load at all under that configuration.

What are we doing wrong?

Thanks.
--
Daniel Wilson
Senior Software Solutions Developer
Embtrak Development Team
http://www.Embtrak.com
DVBrown Company

[Daniel Wilson]

Thanks for the help, Ken. Your point B contained the key, though I missed it
at first. Here are the steps that got it working for us.

The network admin created a domain user named "Browser".

I added the user to the local IIS_WPG group.

I created a new application pool and set it to run under the Browser
identity.

I set the LogoBrowser application to run in that new application pool.

Finally, I gave Browser full control of Windows\Temp. See
http://www.error-bank.com/microsoft.publi c.dotnet.framew ork.webservices/9Z************* *********@news4 .srv.hcvlny.cv. net_Thread.aspx

dwilson

"Ken Schaefer" <ke*******@THIS adopenstatic.co m> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..

a) IUSR_<machinena me> is a *local* account. You can't assign it permissions to remote resources

b) If this is a .NET app, then your code probably isn't running under
IUSR_<machinena me> anyway, but rather the process identity for the worker
process (w3wp.exe) that's services your web app

c) If you want to use a custom account for a web app pool identity, then
place that account into the IIS_WPG group on the IIS server (at the very
least), so that it has the necessary permissions to run. If that still
doesn't work, consult this KB article here, to see if anything else is
missing: http://support.microsoft.com/?kbid=812614

Hope that helps

Cheers
Ken

"Daniel Wilson" <d.******@embtr ak.com> wrote in message
news:ew******** ******@tk2msftn gp13.phx.gbl...

I have a client who is trying to deploy a webservice I wrote. The web
service reads a file on a file server and delivers information about it.
The
file needs to be inaccessible to the user of the webservice because it is intellectual property.

This sounds easy. Just give the IUsr account on the web server, a 2003
server running IIS6, read rights to the files on the file server. Since no HTTP path will get to the file server, the user can't steal the file.

Unfortunately, the service returns the error
Access to the path "\\FS1\Share\De signs\" is denied.

The Everyone group has rights to the share as well as the Designs folder. But this happens.

I suggested running the virtual directory under which the web service ran under a domain account, not the local IUSR. The client reported that the webservice page would not load at all under that configuration.

What are we doing wrong?

Thanks.
--
Daniel Wilson
Senior Software Solutions Developer
Embtrak Development Team
http://www.Embtrak.com
DVBrown Company

[Daniel Wilson]

Thanks, Scott. We just got it working another way as I'll detail in another
branch of this thread. This way might have been easier though.

dwilson

"SQLScott" <SQ******@discu ssions.microsof t.com> wrote in message
news:38******** *************** ***********@mic rosoft.com...

Daniel,

You need pass credentials to the web service that have access to the share. For example:

ws = New csiaigws.csiaig hooks

Dim cache As New CredentialCache

cache.Add(New Uri("http://localhost/CSIAIGWS/"), "negotiate" , New
NetworkCredenti al("domainuser" , "password", "domain"))

ws.Credentials = cache

The credentials that you use in the Cache.Add this way you don't have to
mess with IUSR or anything else.

Let me know if you have any questions about this. HOpe this helps...

Scott
"Daniel Wilson" wrote:

Thanks for the suggestions. They've tried those ideas today ... to no
avail.

Any more ideas?

Thanks.

dwilson
"Ken Schaefer" <ke*******@THIS adopenstatic.co m> wrote in message
news:%2******** ********@TK2MSF TNGP14.phx.gbl. ..

a) IUSR_<machinena me> is a *local* account. You can't assign it

permissions

to remote resources

b) If this is a .NET app, then your code probably isn't running under
IUSR_<machinena me> anyway, but rather the process identity for the worker process (w3wp.exe) that's services your web app

c) If you want to use a custom account for a web app pool identity, then place that account into the IIS_WPG group on the IIS server (at the very least), so that it has the necessary permissions to run. If that still
doesn't work, consult this KB article here, to see if anything else is
missing: http://support.microsoft.com/?kbid=812614

Hope that helps

Cheers
Ken

"Daniel Wilson" <d.******@embtr ak.com> wrote in message
news:ew******** ******@tk2msftn gp13.phx.gbl...
>I have a client who is trying to deploy a webservice I wrote. The web
> service reads a file on a file server and delivers information about it. > The
> file needs to be inaccessible to the user of the webservice because it

is

> intellectual property.
>
> This sounds easy. Just give the IUsr account on the web server, a

2003 > server running IIS6, read rights to the files on the file server. Since no

> HTTP path will get to the file server, the user can't steal the

file. >
> Unfortunately, the service returns the error
> Access to the path "\\FS1\Share\De signs\" is denied.
>
> The Everyone group has rights to the share as well as the Designs

folder.

> But this happens.
>
> I suggested running the virtual directory under which the web

service ran

> under a domain account, not the local IUSR. The client reported

that the

> webservice page would not load at all under that configuration.
>
> What are we doing wrong?
>
> Thanks.
>
>
> --
> Daniel Wilson
> Senior Software Solutions Developer
> Embtrak Development Team
> http://www.Embtrak.com
> DVBrown Company
>
>
>
>