Hi,
I have written a webservice using WCF. Everything works fine and I can
consume the webservice using wsdl, svcutil or visual studio as long as
the application pool is running under network_service or an account that
is a member of the local administrators group.
This webservice needs to run as a different user. When I change the
identity, the request http://server/myservice.svc?xsd=xsd0 fails (IIS
Log indicated an HTTP/200 (OK) - but no data is returned to the client)
and hence, I cannot consume the service as the complete schema is not
returned. The page http://server/myservice.svc?wsdl works fine, it's
just the xsd=xsd0, xsd=xsd1 etc.. that don't work. I've tried monitoring
using regmon and filemon but have been unable to find a cause for this.
Any tips anyone? I really don't want the app to run under an identity
that is local administrator, and network_service does not have the
appropriate rights on the network services that this webservice accesses.
Regards,
Arild
Arild Bakken - 21 Mar 2007 11:47 GMT
> Hi,
>
> I have written a webservice using WCF. Everything works fine and I can
> consume the webservice using wsdl, svcutil or visual studio as long as
> the application pool is running under network_service or an account that
> is a member of the local administrators group.
Actually, being member of the local administrators group does not fix
the problem. Being a domain administrator does though... I don't get
this. Also when running as that serviceaccount I keep getting the
ASP.NET Event ID 1093 indicating that it could not read the
cache memory limit. I fixed that using the MetaAcl.vbs script but still
noe xsd from the WCF webservice.
Regards,
Arild
Arild Bakken - 21 Mar 2007 12:17 GMT
Forget that last post about local administrator not being enough - it
was probably my browsercache or a missing iisreset that led me to
misinterpret the results.
I've now used MetaAcl to grant the serviceaccount full access to the
entire IIS MetaBase and that did not do the trick. A filemon to scan for
any access denied problems results in none - regmon to scan for any
access denied problems does result in some keys regarding certificates
but I also get those when being local admin and when running as network
service so I don't think that is the problem.
Am I looking at a complete reinstall of these servers (there are two in
a NLB)? Will it even help to reinstall?
Regards,
Arild
(getting frustrated)
Arild Bakken - 21 Mar 2007 15:57 GMT
> Hi,
>
> I have written a webservice using WCF. Everything works fine and I can
> consume the webservice using wsdl, svcutil or visual studio as long as
> the application pool is running under network_service or an account that
> is a member of the local administrators group.
Ah - found it!
I was monitoring the w3wp.exe process, but it spawns off a csc.exe
process when generating the xsd and when monitoring that one I could see
that the account did not have enough rights on the Windows\Temp folder.
I would have expected the IIS_WPG group to have enough rights to perform
the required operations though. Adding "list contents" and "delete"
rights to this group (same as the network service account has) solved it.
Regards,
Arild