developing site in vs2010 but changed to local IIS

Question

If I run a 2010 visual studio C# web project using the "Use Visual Studio Development Server" in the project settings my app opens up fine and the CSS renders and all images render.

If I change the property of the project to use the Local IIS Web Server and I try to run the project. I get a prompt almost about as many for how many images / css files I have linked. If i keep clicking cancel the web page appears but all the images are missing and the css file is not rendered (formatting looks like hell).

I thought ok this ought to be some sort of security issue. I have the project setup in the web config file to use "Windows" authentication and I also have enabled anonymous access. I've added the network / network service account and gave full rights. I've added the ASPNET account on my local machine and gave full access. I've even added my domain of users and even got so desperate as to give them full access...

no luck..I still get prompted, and If I try to browse to one of the images directly in the url: http://localhost/mysite/images/myimage.jpg I get the error:

Access is denied. Description: An error occurred while accessing the resources required to serve this request. You might not have permission to view the requested resources.

Error message 401.3: You do not have permission to view this directory or page using the credentials you supplied (access denied due to Access Control Lists).

I don't know what else to do or change to get this to work....

Answer 1

The error message you are seeing (Error message 401.3: You do not have permission to view this directory or page using the credentials you supplied (access denied due to Access Control Lists)) usually occurs because the Application Pool user that executes the web application does not have NTFS Read permissions to the css and image files that are being requested.

A web application runs under an Application Pool, which has a user assigned to it. You can find out which Application Pool your application is using by checking Basic Settings for the site.

Once you know what Application Pool you are using, you can view which user is configured to run that Application Pool by checking Application Pools, select Advanced Settings for your app pool, then look at Advanced Settings -> Process Model -> Identity.

By default, Application Pools are set to use the AppPoolIdentity user (incidentally, in case you need it, the username for this user is IIS APPPOOL\ApplicationPoolName, so in my case it would be IIS APPPOOL\mywebapp). This user is a member of both the Users group and the Authenticated Users group. If your Application Pool is configured to use the AppPoolIdentity user, the easiest way to resolve the permissions issue you are having is to make sure that the Users group at least has Read & Execute, List folder contents, and Read access to the web root folder for the application, along with all files and subdirectories. On my test machine, Authenticated Users also has all access allowed, with the exception of Full Control. (Note: in the interest of correctness, these ACLs are applied whenever I create a new folder under C:. If you want to, you might be able to get away without adding Authenticated Users or just specifying Read access for Users. I'm not going to try to determine what the actual minimum access required is here).

To specify these permissions, right click on the folder than contains the web application in Windows Explorer, go to Properties > Security, click Edit, and then use Add to add the groups. Note that after you add the groups, you will probably need to click the Advanced button > Change Permissions > check the "Replace all child object permissions ..." button and then click OK to grant permissions to all child objects in the folder (see below). After you complete this operation, you can check one of the .css files to make sure the groups have been added properly.

Once those permissions have been added, IIS should be able to serve up the css and image files.

As a side note, if you are getting a Windows login prompt, then you most likely have "Windows Authentication - 401 Challenge" enabled under the Authentication section in IIS for your web application (see below). If you do not have that setting specified, then you will not get a prompt when attempting to view a file that does not have proper ACLs. Instead, you will just get the error message. The prompt will not be shown.

I verified this information using Windows 7 Ultimate and IIS 7.5, so if you are using a different OS YMMV, but I believe IIS should behave as described.

Hope that helps. If you have any questions please let me know.