Unauthorized access when writing to file

Question

I have a asp.net website where the users have the possibility to print a document. This document is first written to a folder on the server and then opened/printed by the client. When deploying the website on IIS server I did encounter a few times issues when a user tried to print the document. Apparently the IIS user on the server had insufficient access rights to write to the local folder and thus throwing an unauthorized access exception.

which one is the IIS user and how do I give it write access to a folder on the server in .net?

Answer 1

I would give write / modify access to the IUSR_MACHINE and NETWORK SERVICE accounts. To actually change the permissions, find the folder in Windows Explorer, get the Folder Properties. On the security tab, click the user in the list (you may have to "ADD" a user to the list first), then check the appropriate checkboxes under the Allow column.

As an aside, when ever I am stumped by a permissions issue, Sysinternals Process Monitor nearly always solves it. Run procmon.exe, set up the filters by excluding processes of known good processes (Right click on the process name, and select "Exclude 'explorer.exe'"). I also typically exclude known results like SUCCESS, and a few others. You can then reproduce the problem, and a bright shining "ACCESS DENIED" entry will be listed at the bottom of the list, including the name of the user account, and the specific asset it was trying to access.

Download Link: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Answer 2

Usially it's NETWORK SERVICE user, grand to it write permissions on the required folder.

Answer 3

There's also frequently a user named "IUSR" that is used by that process.

Answer 4

On server class operating systems, ASP.NET 2.0 runs under the "Network Service" account. (I'm not sure whether it uses a different account for XP.)

Rather than giving that account more access, it's probably worth making ASP.NET run under a dedicated account. This PDF explains how to do it. (That explains for IIS 6.0; it may be slightly different under IIS 7.0, but it's probably broadly the same.)

Answer 5

You can use ASP.NET impersonation - http://msdn.microsoft.com/en-us/library/aa292118(VS.71).aspx - to check if your program can run under a chosen user account.

I find this to be quite useful for exploring account permissions related issues.