Microsoft KB Archive/323293

= FIX: &quot;Access is denied&quot; error message when you try to access indexing service from ASP.NET with impersonation enabled =

Article ID: 323293

Article Last Modified on 7/5/2006

-

APPLIES TO


 * Microsoft ASP.NET 1.0
 * Microsoft Index Server 2.0
 * Microsoft OLE DB Provider for Index Server 3.0

-



This article was previously published under Q323293



SYMPTOMS
When you search against Index Server through an ASP.NET page, you may receive the following error message:

Access is denied. Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.OleDb.OleDbException: Access is denied.

This behavior is observed only if you enable impersonation for the ASP.NET Web application and if the security context under which the ASP.NET worker process (Aspnet_wp.exe) runs is the ASPNET account.



Service pack information
To resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to obtain the latest Windows 2000 service pack



WORKAROUND
Use one of the following methods to work around this problem:  Disable impersonation for the whole ASP.NET Web application. This is the default setting.  Disable impersonation only for the particular .aspx page that does the Index Server search. To do this, add a tag to the Web.config file as follows:     

If these workarounds are not acceptable to you, you may change the security context under which the ASP.NET worker process runs to the SYSTEM account. However, Microsoft does not recommend that you set the security context of the ASP.NET worker process to the SYSTEM account because the SYSTEM account is a highly privileged Administrator account on the Web server computer. Use this workaround only if none of the other workarounds are acceptable to you.

To change the security context under which the ASP.NET worker process runs, set the userName attribute to SYSTEM, and then set the Password attribute to autogenerate in the  section of the Machine.config file. The Machine.config file is located in the C:\ \Microsoft.Net\Framework\v1.0.3705\Config folder.



STATUS
Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the &quot;Applies to&quot; section. This bug was corrected in ASP.NET (included with the .NET Framework) 1.1. Microsoft has confirmed that this is a problem in Microsoft Windows 2000. This problem was first corrected in Microsoft Windows 2000 Service Pack 4.

<div class="moreinformation_section">

Steps to Reproduce the Behavior
<ol> Start Microsoft Visual Studio .NET.</li> Create an ASP.NET Web application.</li>  Add the following code in the HTML of an .aspx page: <%@ Page language=&quot;c#&quot; %> <%           System.Data.OleDb.OleDbConnection conn = new System.Data.OleDb.OleDbConnection(&quot;provider=msidxs;&quot;);

conn.Open;

string Sql = &quot;Select DocTitle, vpath, characterization, rank from Scope(' DEEP TRAVERSAL OF \&quot;C:\\\&quot; ') where FREETEXT(' \&quot;ticket\&quot; ') order by rank desc&quot;;

System.Data.OleDb.OleDbDataAdapter da = new System.Data.OleDb.OleDbDataAdapter(Sql, conn);

System.Data.DataSet ds = new System.Data.DataSet;

da.Fill(ds, &quot;SearchResults&quot;); Response.Write(&quot;Search Results: &quot;); for (int i = 0; i < ds.Tables[0].Rows.Count; i++)

{

Response.Write(&quot; &quot; + ds.Tables[0].Rows[i][&quot;vpath&quot;].ToString);

}

%>                   </li>  Modify the Web.config file to enable impersonation as follows: <identity impersonate=&quot;true&quot; /> </li> Make sure that the security context under which the Aspnet_wp.exe worker process runs is the ASPNET account. To do this, set the userName attribute to machine, and then set the Password attribute to autogenerate in the <processModel> section of the Machine.config file.

Note By default, the ASP.NET worker process is set to run under the security context of the restricted ASPNET account.</li> Start the Indexing Service on your computer.</li> Build the application, and then open the .aspx page in your browser. Notice that you receive the error message that is listed in the &quot;Symptoms&quot; section.</li></ol>

<div class="references_section">