即使授予“所有人”访问权限，ASP.NET应用程序也无法访问网络共享

Question

I have two servers: server A which is a web server running an ASP.NET application on IIS, and server B which is an SSIS server with a network share that contains a configuration file.

I need server A to be able to write to the configuration file on server B. This seems fairly straight-forward, however I keep getting the error: "Access to the path \\\\ServerB\\files\\config.xml is denied." What I have done for testing , to make this perfectly clear:

• I have set " Everyone " to have full control of the folder.
• I have set " Everyone " to have read/write access on the share .
• I have set " Everyone " to have full control of the file.
• I have verified that the file is not read-only.

I realize this isn't a good solution, I am just doing this for debugging so please don't comment to tell me not to do this.

Anyhow, even with these things set, I still get "Access is denied." I have also explicitly given access to a number of users, including Network Service , IUSR , Anonymous Logon , and IUSRS group, and it has not fixed the problem.

The application pool on Server A is using ApplictionPoolIdentity . I have Googled and Overflowed and found suggestions to give permissions to things like IIS AppPool\\{Application Pool} or {MACHINE}\\ASPNET, but I cannot access these resources from Server B so I do not understand how this would be possible.

Finally, the perplexing thing is that developers running solutions on their local machines are able to access the file. So it is something to do with how something is configured with Server A, however I cannot figure out what.

Edit: Truly wacky stuff going on here. I have figured out how to enable auditing and get the requests logged in the event viewer on Server B. When the developer runs the process from his local, I can see all the requests logged on Server B. Eg: "A network share object was checked to see whether client can be granted desired access."

However! When attempting to connect from server A, nothing gets logged. Nothing is there at all. Server A throws an "access to the path is denied" error, but I don't even see the request from Server B. :(

Answer 1

It has been long time ago but maybe it could be useful for someone.

Try and use the class NetworkConnection to access to the shared folder. You'll need to specify the path and credentials.

More reference about the class here:

https://gist.github.com/AlanBarber/92db36339a129b94b7dd#file-networkconnection-cs-L15

Answer 2

You seem to be using all Local Identities and I think that will not work on a network share despite what permissions you give. You need to make a domain user and run the app pool with that user and you should be good to go.

Also please do verify if the path is reachable or its access denied. Sometimes we go get the access denied message even though the path was not reachable.

Answer 3

You may need to edit settings in the Group Policy Editor on the machine where the share is hosted.

Open the Group Policy Editor via Start → Run → gpedit.msc. Set the following under Local Computer Policy → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options:

• Network access: Shares that can be accessed anonymously - Enter the name of the network share folder ( files in your question above) in the text field. (Don't include the hostname.)
• Network access: Let Everyone permissions apply to anonymous users - Set to Enabled . (For me, this was necessary for write access to be granted.)

When done making changes in gpedit.msc, from an admin-elevated command prompt, run gpupdate /force to apply the Group Policy changes.

Obviously, you should consider the security implications in your specific situation before making these changes.

Answer 4

您必须根据本文http://blogs.msdn.com/b/vijaysk/archive/2009/02/13/goodbye-network-service.aspx修改ApplicationPoolIdentity，因为它可以与NetworkService身份一起使用

Answer 5

在system.web ，在identity标签上，设置impersonate=true还设置生产服务器的用户名和密码