IIS7: cannot access a database from a page with authentication on local webserver

Vista Ultimate / IIS7
MS Access 2000 database

Hello,

I have an .ASP page that requires authentication. I enabled Windows
Authentication in IIS Manager > Authentication.

For the database, I successfully completed the solutions and workaround in
KB article at
http://support.microsoft.com/kb/926939/. I also gave IUSR > Modify rights to
the containing folder and database files.

The ASP page begins as follow:

<% @Language=JScript %>
<%
var bAccessDenied = (Request.ServerVariables("LOGON_USER") == "");

if (bAccessDenied)
{
Response.Status = "401 access denied";
}
else
{
var oConn = Server.CreateObject("ADODB.Connection");
var strDBPath = Server.MapPath("/db/data.mdb");
var strOpen = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" + strDBPath;

oConn.Open(strOpen); // <<<< JET error here when authenticated
}
%>

When I open the page on a remote server (running IIS6) I can successfully
access the page but when I try it on my local webserver, I get:

Microsoft JET Database Engine error '80004005'
Unspecified error

Without authentication, the page works correctly remotely and locally.
Could you please tell me how to fix this issue? Thank you.

--
Noël
http://noeld.com/

Re: IIS7: cannot access a database from a page with authentication on local webserver

Noël wrote on Thu, 9 Aug 2007 12:19:16 +0200:

> Vista Ultimate / IIS7
> MS Access 2000 database

> Hello,

> I have an .ASP page that requires authentication. I enabled Windows
> Authentication in IIS Manager > Authentication.

> For the database, I successfully completed the solutions and workaround
> in KB article at http://support.microsoft.com/kb/926939/. I also gave IUSR
> > Modify rights to the containing folder and database files.

> The ASP page begins as follow:

> <% @Language=JScript %>
> <%
> var bAccessDenied = (Request.ServerVariables("LOGON_USER") == "");

> if (bAccessDenied)
> {
> Response.Status = "401 access denied";
> }
> else {
> var oConn = Server.CreateObject("ADODB.Connection");
> var strDBPath = Server.MapPath("/db/data.mdb");
> var strOpen = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" +
> strDBPath;

> oConn.Open(strOpen); // <<<< JET error here when authenticated }
> %>

> When I open the page on a remote server (running IIS6) I can
> successfully access the page but when I try it on my local webserver,
> I get:

> Microsoft JET Database Engine error '80004005'
> Unspecified error

> Without authentication, the page works correctly remotely and locally.
> Could you please tell me how to fix this issue? Thank you.

> --
> Noël http://noeld.com/



As it works without authentication the permissions for the IUSR account are
correct. However, with authentication the credentials of the authed user
will be used instead - you need to check those to ensure it has the same
permissions as you've given the IUSR account.

Dan

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hello Dan,

Thanks for your reply. The Authenticated Users have Read/Write/Modify rights
on the folder and the database. I tried the following command (not sure if
it is correct though) :

icacls %windir%\serviceprofiles\networkservice\AppData\Local\Temp /grant
"Authenticated Users":(CI)(S,WD,AD,X)
processed file: C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp
Successfully processed 1 files; Failed processing 0 files

But that did not help. Could you please provide more details about what I
should exactly do. Thank you.

--
Noël
http://noeld.com/


"Daniel Crichton" wrote in message
news:edMwiCp2HHA.2752@TK2MSFTNGP06.phx.gbl...
> Noël wrote on Thu, 9 Aug 2007 12:19:16 +0200:
>
>> Vista Ultimate / IIS7
>> MS Access 2000 database
>
>> Hello,
>
>> I have an .ASP page that requires authentication. I enabled Windows
>> Authentication in IIS Manager > Authentication.
>
>> For the database, I successfully completed the solutions and workaround
>> in KB article at http://support.microsoft.com/kb/926939/. I also gave
>> IUSR
>> > Modify rights to the containing folder and database files.
>
>> The ASP page begins as follow:
>
>> <% @Language=JScript %>
>> <%
>> var bAccessDenied = (Request.ServerVariables("LOGON_USER") == "");
>
>> if (bAccessDenied)
>> {
>> Response.Status = "401 access denied";
>> }
>> else {
>> var oConn = Server.CreateObject("ADODB.Connection");
>> var strDBPath = Server.MapPath("/db/data.mdb");
>> var strOpen = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" +
>> strDBPath;
>
>> oConn.Open(strOpen); // <<<< JET error here when authenticated }
>> %>
>
>> When I open the page on a remote server (running IIS6) I can
>> successfully access the page but when I try it on my local webserver,
>> I get:
>
>> Microsoft JET Database Engine error '80004005'
>> Unspecified error
>
>> Without authentication, the page works correctly remotely and locally.
>> Could you please tell me how to fix this issue? Thank you.
>
>> --
>> Noël http://noeld.com/
>
>
>
> As it works without authentication the permissions for the IUSR account
> are correct. However, with authentication the credentials of the authed
> user will be used instead - you need to check those to ensure it has the
> same permissions as you've given the IUSR account.
>
> Dan
>

Re: IIS7: cannot access a database from a page with authentication on local webserver

Mmm.. authenticated user. have you try granting the actual user doing the
access?
or you can try the loaduserprofile setting.


--
Regards,
Bernard Cheah
http://www.iis.net/
http://msmvps.com/blogs/bernard/


"Noël Danjou" wrote in message
news:u6jZl2q2HHA.5116@TK2MSFTNGP04.phx.gbl...
> Hello Dan,
>
> Thanks for your reply. The Authenticated Users have Read/Write/Modify
> rights on the folder and the database. I tried the following command (not
> sure if it is correct though) :
>
> icacls %windir%\serviceprofiles\networkservice\AppData\Local\Temp /grant
> "Authenticated Users":(CI)(S,WD,AD,X)
> processed file:
> C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp
> Successfully processed 1 files; Failed processing 0 files
>
> But that did not help. Could you please provide more details about what I
> should exactly do. Thank you.
>
> --
> Noël
> http://noeld.com/
>
>
> "Daniel Crichton" wrote in message
> news:edMwiCp2HHA.2752@TK2MSFTNGP06.phx.gbl...
>> Noël wrote on Thu, 9 Aug 2007 12:19:16 +0200:
>>
>>> Vista Ultimate / IIS7
>>> MS Access 2000 database
>>
>>> Hello,
>>
>>> I have an .ASP page that requires authentication. I enabled Windows
>>> Authentication in IIS Manager > Authentication.
>>
>>> For the database, I successfully completed the solutions and workaround
>>> in KB article at http://support.microsoft.com/kb/926939/. I also gave
>>> IUSR
>>> > Modify rights to the containing folder and database files.
>>
>>> The ASP page begins as follow:
>>
>>> <% @Language=JScript %>
>>> <%
>>> var bAccessDenied = (Request.ServerVariables("LOGON_USER") == "");
>>
>>> if (bAccessDenied)
>>> {
>>> Response.Status = "401 access denied";
>>> }
>>> else {
>>> var oConn = Server.CreateObject("ADODB.Connection");
>>> var strDBPath = Server.MapPath("/db/data.mdb");
>>> var strOpen = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" +
>>> strDBPath;
>>
>>> oConn.Open(strOpen); // <<<< JET error here when authenticated }
>>> %>
>>
>>> When I open the page on a remote server (running IIS6) I can
>>> successfully access the page but when I try it on my local webserver,
>>> I get:
>>
>>> Microsoft JET Database Engine error '80004005'
>>> Unspecified error
>>
>>> Without authentication, the page works correctly remotely and locally.
>>> Could you please tell me how to fix this issue? Thank you.
>>
>>> --
>>> Noël http://noeld.com/
>>
>>
>>
>> As it works without authentication the permissions for the IUSR account
>> are correct. However, with authentication the credentials of the authed
>> user will be used instead - you need to check those to ensure it has the
>> same permissions as you've given the IUSR account.
>>
>> Dan
>>

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hi Noeld,

As an example, if the authentication user account is Tester, the mdb file
is located at: C:\Users\Tester\Documents\databasename.mdb . Then we need to
grant Tester account with Read/Write permission to the following pathes:

1. Give the Tester account permission to:
%windir%\serviceprofiles\networkservice\AppData\Local\Temp

2. Give the Tester account Full Control permission to the database file:
c:\Users\Tester\Documents\databasename.mdb

3. Give the Tester account Full Control permission to the database folder:
c:\Users\Tester\Documents

You can grant the permission by using Windows explorer instead of using the
icacls command. After applying the changes on permission, restart IIS
services to clear up ACL cache and test again.

Please update here how things are going. If problem still persists, we will
assist on further troubleshooting.

Have a nice weekend.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Re: IIS7: cannot access a database from a page with authentication on local webserver

Thanks Bernard and WenJun for your replies and suggestions.

I used Windows Explorer to give full permissions to my account (i.e. my full
name) for the two paths mentioned. I then restarted IIS7 using the IIS
Manager but to no avail, the authenticated pages still give the same
"Unspecified error".

Here is a summary of the rights for all users:

* %windir%\serviceprofiles\networkservice\AppData\Local\Temp:

CREATOR OWNER: special permissions
SYSTEM: Full control
NETWORK SERVICE: Full control
Noël Danjou (MYCOMP\Noël Danjou): Full control
Administrators (MYCOMP\Administrators): Full control
Users (MYCOMP\Users): special permissions

* d:\web\mysite\db

Authenticated Users: Full control
IUSR: Modify, Read&Execute, List folder, Read, Write
SYSTEM: Full control
Noël Danjou (MYCOMP\Noël Danjou): Full control
Administrators (MYCOMP\Administrators): Full control
Users (MYCOMP\Users): Modify, Read&Execute, List folder, Read, Write


I also noticed that the pages or errors take about 15 to 20 seconds to show
up when I open a new browser. This may not be related to the errors though
because this also happens on non authenticated pages.

I'd appreciate any other suggestions that you can think of. Thank you.

Sincerely
--
Noël
http://noeld.com/

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hi Noeld,

Please further add Full Control for the authenticated user account and
Network Service account to the keys below by using regiedit:

HKLM\Software\ODBC
HKLM\System\Current Control Set\Services\Winsock2\Parameters

If still no progress, you should use filemon or regmon to trace the I/O of
file system and registry when reproducing the error and see where the exact
ACCESS DENIED error occurs. You can refer to the steps in below article:

Troubleshooting ASP.NET using Filemon
http://support.microsoft.com/kb/890960

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hi WenJun,

Thanks for your information.

I wanted to experiment step-by-step to try to identify which key was
possibly the problem. Since I don't use ODBC but the Jet engine, I first
experimented with the WinSock2\Parameters key. I only gave Full Control to
the "Authenticated Users" account. I still got the "Unspecified error" after
restarting IIS7 but after a system restart I am now able to access the local
authenticated ASP pages without any error.

Would you still recommend to give Full Control to the Network Service
account as well?

Thanks for your help.
--
Noël

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hi Noeld,

Glad to see we've got progress on the problem.

Yes, I'd suggest you add Network Service as well. ASP uses authenticated
users' credential. However Network Service account will be the default
identity for most of other server side application technologies like
ASP.net.

Please let me know if there is still anything unclear.

Have a great week.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hi Noeld,

Is there any further problem persists for this case? If not, I will go
ahead and close this post.

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Re: IIS7: cannot access a database from a page with authentication on local webserver

Hi WenJun,

I added Full Control permission for the Network Service account to the
HKLM\System\Current Control Set\Services\Winsock2\Parameters Registry key as
well.

I can view the authenticated pages locally now so the problems is fixed.
Thanks for your assistance.

Sincerely,
--
Noël

Re: IIS7: cannot access a database from a page with authentication on local webserver

Noeld,

Glad to see the problem has been resolved. You are always welcome.

Have a great day.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

==================================================

Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/de fault.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at:

http://msdn.microsoft.com/subscriptions/support/default.aspx .

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.