DV1119 - Installation Issues for DOVICO Timesheet (permissions & access rights)

The information in this article applies to:

• DOVICO Timesheet

INTRODUCTION

Computer security needs have increased dramatically through the years resulting in operating systems that are by default more and more locked down. DOVICO strives to provide installations that will install successfully into these locked down operating systems.  Our current DOVICO Timesheet products will install successfully into environments that have default security permissions enabled provided the user does have full administrative access when the installation is run. There are of course many operating systems that have been further hardened by applying more restrictive permissions to users and groups, sometimes resulting in the failure of the installation, or failure of the application to execute properly. This article is designed to discuss these issues.

CAUSE

The software configuration problems that can be caused by security permissions are too numerous to mention. In some cases you will get an "Access denied" error message, and other times you may end up seeing a message that is seemingly unrelated to permissions but is a definite result of the system restricting access to a particular portion of OS functionality.

The DOVICO Timesheet installation checks to see if the user is part of the local Administrators group, but if the local Administrators group has been banned from certain operations, then the installation could still fail. There are also an entirely different set of permissions to think about in relation to the web application itself. More information on Internet Information Services permissions can be found on Microsoft’s site, but a brief description of problems/resolutions can be found below:

PROBLEM – RECEIVING A STANDARD BROWSER ACCESS DENIED MESSAGE WHEN STARTING THE APPLICATION
This results from IIS not having the appropriate rights to read the files within the application directory.

See “Solving the permissions problem” below

PROBLEM – SEEING SOME CONTENT FROM LOGIN PAGE, BUT NOT ALL GRAPHICS, CONTENT ETC.
The ASP.NET worker process account or the IIS anonymous account may not have access to the folders/files in the DOVICO Timesheet application.

See “Solving the permissions problem” below

PROBLEM – RECEIVING AN APPLICATION SERVER UNAVAILABLE ERROR
This can also be caused by the user account executing the ASP.NET application not having rights to the application folder.

PROBLEM – A STANDARD 404 ERROR APPEARS (PAGE CANNOT BE FOUND)
If using Windows Server 2003 and above or Windows XP 64-bit and above this could be a result of web services extensions not being enabled. If you are using DOVICO Timesheet version 8, make sure ASP.NET v1.1.4322 is enabled. If using version 9, make sure ASP.NET v2.0.50727 is enabled.

In all operating systems this can also be a result of the url used to access the application not being correct.

For version 8 and Windows 2003 Server/Windows XP 64-bit

1. Go to Control Panel, Add/Remove Programs, Add/Remove Windows Components.
2. Choose Application Server.
3. Click Details.
4. Choose asp.net.

For version 8 and any other OS (not Windows 2003 Server/Windows XP 64 bit)

1. Go to .NET framework 1.1 directory.
2. Run aspnet_regiis /I from <windows\microsoft.net\framework\v1.1.4322>

For version 9 and Windows XP/Windows Server 2003 - Server Application Unavailable.

1. Ensure the ASPNET Account has Read/Write Priviladges on the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Temporary ASP Files, the C:\Temp and the C:\inetpub\wwwroot\DovTimesheet directory.
2. Modify the machine.config file to force ASP to run under a different user account (Warning: DOVICO Software does not recommend modifying the machine.config file to allow ASP to run under a second user account.  This step is provided as an additional unsupported step in resolving the issue and it is the users responsiblity to understand the risks in performing the following action.)
3. Open the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG directory
4. Open the machine.config file with a simple text editor such as notepad.
5. Find the line that begins with <ProcessModel, the existing line should read  

        <processModel autoConfig="true"/>

     Replace it with the following:

        <processModel userName="SYSTEM" password="autogenerate"/>

      6.  Restart the World Wide Web Publishing Service.       

For version 9 and Windows 2003 Server/Windows XP 64-bit

1. Go to .NET framework 2.0 directory.
2. Run aspnet_regiis /I from <windows\microsoft.net\framework\v2.0.50727>

For version 9 and Windows Vista

1. Select Start / Control Panel, Programs, Programs and Features.
2. From left-hand task bar select Turn Windows Features On or Off.
3. Click Continue or enter your credentials (if you have User account control turned on).
4. From the Features tree, drill down on Internet Information Services.
5. Drill down on World Wide Web Services.
6. Drill down to Application Development Features.
7. Check the ASP.NET check boxes.
8. Click the OK button.

In any of these cases if the change does not make it work, a reboot would be recommended.

Solving the "permissions problem".

In order for DOVICO Timesheet to execute correctly, two different user accounts permissions need to be considered. The user account used to anonymously access the file system via IIS (normally IUSR_<MACHINENAME>) and the ASP.NET worker process account (In Windows 2000 and XP this is ASPNET by default and in Windows Server 2003 it is NETWORK SERVICE). Keep in mind that in both these cases, if you have configured a different user account, then you will need to use that instead.

Locate the virtual directory for the DOVICO Timesheet application and ensure that both the IIS_<MACHINE_NAME> account and the ASP.NET account  have read and read+execute and list folder contents on the root virtual directory folder and all folders and files underneath. (Remember to click Advanced when applying security and choose “Replace permissions on all child objects…”

 If you are still experiencing problems, you can try these steps in the following order to see if it helps:

• If using Windows XP 64-bit and above or Windows Server 2003 ensure appropriate web service extensions are enabled.

• Check to make sure the virtual directory for dovtimesheet is ASP.NET v1.1.4322 for version 8 or 2.0 for version 9.

• Next, do a test to see if the web server can serve static content. For the best result, try a .gif from our images directory to see if it can be viewed through the browser:  (e.g.  http://localhost/dovtimesheet/images/gears.gif”). If this works, then there is a good chance that your IUSR_<MACHINE_NAME> account has the correct permissions

• Verify your virtual directory has both the ASP.NET worker process account permissions and the necessary IIS anonymous access permissions (as described above).

• In some cases, changing the above is not enough.  Sometimes you have to re-install ASP.NET.  Go to your <OS\Microsoft.net\Framework\v1.1.4322> if using version 8, or <OS\Microsoft.net\Framework\v2.0.50727> if using version 9 and run "aspnet_regiis –i" to re-install ASP.NET.

• You can also edit the userName attribute of the processModel element of the machine.config to change it to System to see if this has a positive affect (Restart IIS in this case as well). The machine.config for .NET 2.0 does not have the processModel entries by default so you’ll need to copy them out of machine.config.comments.

If you are still having trouble at this point, attempt to restart IIS through the Services applet in the Control Panel.  Sometimes these changes are not picked up right away.