IIS account permissions

I have a webservice running under sharepoint on a standard Server2003 / IIS6 installation. This web service needs to open and read a file from a share on another computer in the same domain. At the moment I am getting

System.UnauthorizedAccessException: Access to path '\ strand \ DROPBOXES \ MattTrinder \ SharepointShared \ bd116dfa-be0e-4c58-93e6-3fb93fa0ef22.tmp' is denied. at System.IO .__ Error.WinIOError (Int32 errorCode, String maybeFullPath)

What permissions should I grant in order for the accounts to allow this web service to open and read the file?

Using "\ sharepointserver \ c $" works great ...

thank

Matt

+1


source to share


3 answers


The account you grant access to must exist on the target (where the share exists) (either a single domain account or a local account with the same password). Since the IIS user usually has an auto-generated password and is local, this is tricky.



The way we solve this is to run the website as a different user (which we created ourselves) and grant these users permissions to access the share on the remote PC. Note that both the access permissions must be correct and the file system permissions.

+3


source


You need to grant read access at the file system level and on the shared folder. The problem is that sharepoint is running (perhaps because it can be changed) on a network service account that has no network access.

options:



  • If you are using Integrated Authentication for the web service. Next, you must grant permissions to the users who are running the web service client. But don't walk this dark path. Because delegation is very difficult to set up.
  • If you have anonymous access to the web service, ensure that the application pool started by the web service is started with the permission of an explicit user who has access to the specified file. This can be configured using the sharepoint administration site. Or with computer control mmc.
+2


source


Classic asmx web services run as the IUSR_ account by default. It may not have permission to access the network path. You can change this to a domain account by changing the application pool ID.

+1


source







All Articles