VS.NET 2005 and the "allowDefinition='MachineToApplication'" error

[Guest]

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Alvin Bruney [MVP]]

hmmm, you are best served by inspecting the IIS virtual directory to see if
it *somehow became unmapped. If it is, just create a new virtual directory
pointed to the application. And watch out for the little elves that change
things when no one is looking

--
________________________
Warm regards,
Alvin Bruney [MVP ASP.NET]

[Shameless Author plug]
Professional VSTO.NET - Wrox/Wiley
The O.W.C. Black Book with .NET
www.lulu.com/owc, Amazon
Blog: http://www.msmvps.com/blogs/alvin

 

[Guest]

This exception almost always occurs when a web project is not configured as
an IIS application.
Peter

 

[Guest]

I don't understand, though -- *what* became unmapped? I haven't
touched IIS on my machine to date, which is running a vanilla
installation of Windows XP Professional and Visual Studio .NET 2005.
Do I need to create a virtual directory for each and every project I
want to test?

I thought VS.NET 2005 came with its own internal IIS-Lite webserver,
which is why you can debug a project without configuring IIS, and which
is why you also see a dynamic port number when you debug a script
without actually deploying it. Is that belief mistaken?


-= Tek Boy =-

hmmm, you are best served by inspecting the IIS virtual directory to see if
it *somehow became unmapped. If it is, just create a new virtual directory
pointed to the application. And watch out for the little elves that change
things when no one is looking

--
________________________
Warm regards,
Alvin Bruney [MVP ASP.NET]

[Shameless Author plug]
Professional VSTO.NET - Wrox/Wiley
The O.W.C. Black Book with .NET
www.lulu.com/owc, Amazon
Blog: http://www.msmvps.com/blogs/alvin
-------------------------------------------------------

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Juan T. Llibre]

re:

Do I need to create a virtual directory for each and every project I
want to test?

No. Only for the ones which use sections defined as
allowDefinition='MachineToApplication' in its configuration file.

re:

Is that belief mistaken?

No, it's not, but the same rules apply for the internal web server as for IIS.
If you need to use 'MachineToApplication' sections, you must create a virtual directory.

Take a look at machine.config.comments in:
Drive:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG

Search for allowDefinition="MachineToApplication" in that file.
You will find 17 sections marked as allowDefinition="MachineToApplication".

If you use any of those sections, you'll need to create a virtual directory.
If you don't use any of those sections, you don't need to create a virtual directory.



Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

I don't understand, though -- *what* became unmapped? I haven't
touched IIS on my machine to date, which is running a vanilla
installation of Windows XP Professional and Visual Studio .NET 2005.
Do I need to create a virtual directory for each and every project I
want to test?

I thought VS.NET 2005 came with its own internal IIS-Lite webserver,
which is why you can debug a project without configuring IIS, and which
is why you also see a dynamic port number when you debug a script
without actually deploying it. Is that belief mistaken?


-= Tek Boy =-

hmmm, you are best served by inspecting the IIS virtual directory to see if
it *somehow became unmapped. If it is, just create a new virtual directory
pointed to the application. And watch out for the little elves that change
things when no one is looking

--
________________________
Warm regards,
Alvin Bruney [MVP ASP.NET]

[Shameless Author plug]
Professional VSTO.NET - Wrox/Wiley
The O.W.C. Black Book with .NET
www.lulu.com/owc, Amazon
Blog: http://www.msmvps.com/blogs/alvin
-------------------------------------------------------

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Guest]

I didn't have to touch IIS when I first wrote and ran the scripts the
first time around, but I'll give this a shot, anyway.

How do I configure a web project as an IIS application? I'm running
Windows XP Professional, so I can only have one IIS "web site". I
tried setting up a virtual directory beneath the default web site that
pointed to the folder where my code lives, and made sure the "Virtual
Directory > Application Settings > Application name" field in IIS had a
value (it does). When I tried to access the application
(http://localhost:99/tinkering/FirstPage.aspx), I get the following
error:

==========================================
Server Application Unavailable

The web application you are attempting to access on this web server is
currently unavailable. Please hit the "Refresh" button in your web
browser to retry your request.

Administrator Note: An error message detailing the cause of this
specific request failure can be found in the application event log of
the web server. Please review this log entry to discover what caused
this error to occur.
==========================================


So I went ahead and opened up the "Event Viewer > Application" window,
where I saw the following detailed error message:

==========================================
Failed to execute the request because the ASP.NET process identity does
not have read permissions to the global assembly cache. Error:
0x80070005 Access is denied.
==========================================


I've heard of the GAC, but I don't know enough about it to fix my
problem, or even know where to start.


-= Tek Boy =-

 

[Guest]

Juan --

So whether or not I need to use a virtual directory depends on whether
I make use of any of the sections that have
[allowDefinition='MachineToApplication'] in machine.config.comments?
I'm assuming I can determine what sections I use by poring over all the
"using <namespace>" statements at the top of my code-behind -- is that
correct? Here's a list of those using statements from the top of my
codebehind (CS) page:

==============================================
using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Globalization;
==============================================

From what I can tell, I don't use any of the namespaces

[allowDefinition='MachineToApplication'] declared in the
machine.config.comments file. Or am I still missing something?


-= Tek Boy=-

re:

Do I need to create a virtual directory for each and every project I
want to test?

No. Only for the ones which use sections defined as
allowDefinition='MachineToApplication' in its configuration file.

re:

Is that belief mistaken?

No, it's not, but the same rules apply for the internal web server as forIIS.
If you need to use 'MachineToApplication' sections, you must create a virtual directory.

Take a look at machine.config.comments in:
Drive:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG

Search for allowDefinition="MachineToApplication" in that file.
You will find 17 sections marked as allowDefinition="MachineToApplication".

If you use any of those sections, you'll need to create a virtual directory.
If you don't use any of those sections, you don't need to create a virtual directory.



Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

I don't understand, though -- *what* became unmapped? I haven't
touched IIS on my machine to date, which is running a vanilla
installation of Windows XP Professional and Visual Studio .NET 2005.
Do I need to create a virtual directory for each and every project I
want to test?

I thought VS.NET 2005 came with its own internal IIS-Lite webserver,
which is why you can debug a project without configuring IIS, and which
is why you also see a dynamic port number when you debug a script
without actually deploying it. Is that belief mistaken?


-= Tek Boy =-

hmmm, you are best served by inspecting the IIS virtual directory to see if
it *somehow became unmapped. If it is, just create a new virtual directory
pointed to the application. And watch out for the little elves that change
things when no one is looking

--
________________________
Warm regards,
Alvin Bruney [MVP ASP.NET]

[Shameless Author plug]
Professional VSTO.NET - Wrox/Wiley
The O.W.C. Black Book with .NET
www.lulu.com/owc, Amazon
Blog: http://www.msmvps.com/blogs/alvin
-------------------------------------------------------


A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Guest]

Why would it be /localhost:99/tinkering in IIS? The default http port is
80. Are you sure you aren't confusing this with the built-in VS2005
development web server, whic always uses a random non-defauilt port ?

--
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com

 

[Juan T. Llibre]

re:

Failed to execute the request because the ASP.NET process identity does
not have read permissions to the global assembly cache. Error:
0x80070005 Access is denied.
I've heard of the GAC, but I don't know enough about it to fix my
problem, or even know where to start.

The GAC is located in the directory : \windows\assembly.
Your ASP.NET identity doesn't have permission to read/execute the files in the GAC

Did you change the ASP.NET identity from the default MachineName\ASPNET ?
( for Windows XP installations... )

If you haven't changed the default identity ( by impersonating a different account... ),
you'll need to assign sufficient permissions to MachineName\ASPNET for that directory.

Warning :
You cannot use Windows Explorer to directly edit ACLs for this folder.

Instead, run the following command using your machine's name in place of MachineName:

cacls %windir%\assembly /e /t /p MachineName\ASPNET:R

That will assign, to your ASP.NET identity (MachineName\ASPNET),
the permissions needed to access the assemblies in the GAC.

If you are impersonating a different account, either change the impersonated account
to MachineName\ASPNET, or assign the permissions to the account you're using.

If you did change the impersonated account, you might also have to assign permission
to access, to that account, the directories listed in this MSDN article :

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

 

[Juan T. Llibre]

Usually, what happens is that you use those sections in web.config,
in order to override default settings set in machine.config.

Check your web.config...and see which setting you're using which overrides a default
machine.config setting which is configured as allowDefinition='MachineToApplication'.



Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
Juan --

So whether or not I need to use a virtual directory depends on whether
I make use of any of the sections that have
[allowDefinition='MachineToApplication'] in machine.config.comments?
I'm assuming I can determine what sections I use by poring over all the
"using <namespace>" statements at the top of my code-behind -- is that
correct? Here's a list of those using statements from the top of my
codebehind (CS) page:

==============================================
using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Globalization;
==============================================

From what I can tell, I don't use any of the namespaces

[allowDefinition='MachineToApplication'] declared in the
machine.config.comments file. Or am I still missing something?


-= Tek Boy=-

re:

Do I need to create a virtual directory for each and every project I
want to test?

No. Only for the ones which use sections defined as
allowDefinition='MachineToApplication' in its configuration file.

re:

Is that belief mistaken?

No, it's not, but the same rules apply for the internal web server as for IIS.
If you need to use 'MachineToApplication' sections, you must create a virtual directory.

Take a look at machine.config.comments in:
Drive:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG

Search for allowDefinition="MachineToApplication" in that file.
You will find 17 sections marked as allowDefinition="MachineToApplication".

If you use any of those sections, you'll need to create a virtual directory.
If you don't use any of those sections, you don't need to create a virtual directory.



Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

I don't understand, though -- *what* became unmapped? I haven't
touched IIS on my machine to date, which is running a vanilla
installation of Windows XP Professional and Visual Studio .NET 2005.
Do I need to create a virtual directory for each and every project I
want to test?

I thought VS.NET 2005 came with its own internal IIS-Lite webserver,
which is why you can debug a project without configuring IIS, and which
is why you also see a dynamic port number when you debug a script
without actually deploying it. Is that belief mistaken?


-= Tek Boy =-

hmmm, you are best served by inspecting the IIS virtual directory to see if
it *somehow became unmapped. If it is, just create a new virtual directory
pointed to the application. And watch out for the little elves that change
things when no one is looking

--
________________________
Warm regards,
Alvin Bruney [MVP ASP.NET]

[Shameless Author plug]
Professional VSTO.NET - Wrox/Wiley
The O.W.C. Black Book with .NET
www.lulu.com/owc, Amazon
Blog: http://www.msmvps.com/blogs/alvin
-------------------------------------------------------


A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Guest]

Peter --

My apologies: my boss told me he changed the default port from 80 to 99
for security reasons. I just changed it back and tried to access the
page again (http://localhost/tinkering/FirstPage.aspx), but the same
errors appeared, both on the ASPX page and in the Application log.


-= Tek Boy =-

 

[Guest]

Juan --

I ran the script you suggested, replacing the [MachineName] placeholder
text with my own computer's name. A whole list of stuff was displayed
(the names of the files that had permissions recursively applied to
them?), so I assume it worked, but is there a way to confirm or view
who has permission to access to GAC? When I view the
[\windows\assembly]'s properties (right-click folder > Properties), a
Security tab isn't present, so I'm guessing it's a special folder...

Anyway, I re-started IIS and tried to access my ASPX page again -- same
problem. Btw, while re-checking the Application log I noticed a
warning before the GAC errors occurred:

==========================================
Exception: System.IO.FileLoadException
Message: Could not load file or assembly 'System.Web, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its
dependencies. Access is denied.
==========================================

I'm not sure if that helps, or merely confirms that the problem is
related to GAC permissions, but I thought I'd post it just in case. I
don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?
I'm more than happy to reset any necessary settings... this is my dev
machine, after all.


-= Tek Boy =-

 

[Juan T. Llibre]

re:

I don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?

The script only assigned access permissions to MachineName\ASPNET
It doesn't change the default identity.

The only way to "reset" the impersonated account is to
manually change the impersonation web.config entry:

<identity impersonate="true" username="SomeAccount" password="P@ssw0rd" />

If you want to use the default configured account, eliminate that entry, or configure it as :

<identity impersonate = "false" />

Did you check to see that the directories listed at :
http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx
allow access to the machinename\ASPNET account ?

The easiest way to assign correct permissions to all required directories is to run :

aspnet_regiis -ga MachineName\ASPNET

from a command-line in the .Net Framework directory
( assuming that MachineName\ASPNET is the configured ASP.NET identity )

You may as well verify the account which ASP.NET is running as.
To do that, save the following code as "identity.aspx" and run it.

identity.aspx:
-------------------
<%@ Page Language="VB" %>
<%@ Import NameSpace = System.Security.Principal %>
<script runat="server">
Sub Page_Load()
Dim tmp As String = WindowsIdentity.GetCurrent.Name()
Label1.Text = "ASP.NET is running as the account : " & tmp
End Sub
</script>
<html>
<head>
<title>What account is ASP.NET running as ?</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:Label ID="Label1" Runat="server" Text="Label"></asp:Label>
</div>
</form>
</body>
</html>
------------

Running that script will return the configured ASP.NET account.

The above suggestions ONLY work if you're using the .Net Framework 2.0.
Make sure your virtual directory is configured to use it ( in the MMC's ASP.NET tab ).




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
Juan --

I ran the script you suggested, replacing the [MachineName] placeholder
text with my own computer's name. A whole list of stuff was displayed
(the names of the files that had permissions recursively applied to
them?), so I assume it worked, but is there a way to confirm or view
who has permission to access to GAC? When I view the
[\windows\assembly]'s properties (right-click folder > Properties), a
Security tab isn't present, so I'm guessing it's a special folder...

Anyway, I re-started IIS and tried to access my ASPX page again -- same
problem. Btw, while re-checking the Application log I noticed a
warning before the GAC errors occurred:

==========================================
Exception: System.IO.FileLoadException
Message: Could not load file or assembly 'System.Web, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its
dependencies. Access is denied.
==========================================

I'm not sure if that helps, or merely confirms that the problem is
related to GAC permissions, but I thought I'd post it just in case. I
don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?
I'm more than happy to reset any necessary settings... this is my dev
machine, after all.


-= Tek Boy =-

 

[Guest]

Ok, I've made a bit of progress. Before I go into the explanation,
here's my directory structure:

C:\...\tinkering\ (set up as a virtual directory:
http://localhost/tinkering/)
======================================================
\tinkering\GeneralFunctionsAttempt01\
\tinkering\GeneralFunctionsAttempt01\Default.aspx
\tinkering\GeneralFunctionsAttempt01\Default.aspx\Default.aspx.cs
\tinkering\GeneralFunctionsAttempt01\Web.config
\tinkering\FirstPage.aspx
\tinkering\FirstPage.aspx\FirstPage.aspx.cs
\tinkering\Global.asax
\tinkering\Tinkering.sln
\tinkering\Web.config
======================================================

I was trying to run the ASPX script at
http://localhost/tinkering/FirstPage.aspx, so I had opened the
directory in Visual Studio .NET 2005 (File > Open Web Site >
[C:\...\tinkering\] ). When I tried to compile everything (F5), errors
were raised. However, once I excluded
[\tinkering\GeneralFunctionsAttempt01\Web.config] from the project,
everything recompiled again. My guess is that I created the
[GeneralFunctionsAttempt01] project a few days ago, then created the
[FirstPage.aspx] project in the parent folder -- and that might have
caused problems.

Including [\tinkering\GeneralFunctionsAttempt01\Web.config] still
causes compiling [\tinkering] to fail. Are Web.config files only
allowed in virtual directory and IIS website root directories?


-= Tek Boy =-

 

[Guest]

Your description of impersonation is great. I've seen the term slung
around in many threads, but I always thought it had to do with
traditional ACL / security settings -- I didn't realize it was an
ASP.NET config file setting until just now. So thank you for that.

I just posted ( http://tinyurl.com/yh3als ) a reply to my original,
top-level cry for help. Long story short: I think the problem was that
I had another folder with ASPX code (and a Web.config file) nested
within the folder I was trying to compile. I'm guessing -- and please
correct me if I'm wrong -- that you can only have a Web.config file in
the root directory of the folder you're trying to compile, or the root
directory of folders that are set up as virtual directories (and
therefore have values for Application Name and Starting Point in IIS).

Does any of that make sense? I'm working backwards, trying to figure
out how things work based on when I encounter errors. You, OTOH, know
more about why things work they way they do, and I'm hoping you can
confirm or refute my ideas based on your experience.


-= Tek Boy =-

re:

I don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?

The script only assigned access permissions to MachineName\ASPNET
It doesn't change the default identity.

The only way to "reset" the impersonated account is to
manually change the impersonation web.config entry:

<identity impersonate="true" username="SomeAccount" password="P@ssw0rd" />

If you want to use the default configured account, eliminate that entry, or configure it as :

<identity impersonate = "false" />

Did you check to see that the directories listed at :
http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx
allow access to the machinename\ASPNET account ?

The easiest way to assign correct permissions to all required directoriesis to run :

aspnet_regiis -ga MachineName\ASPNET

from a command-line in the .Net Framework directory
( assuming that MachineName\ASPNET is the configured ASP.NET identity )

You may as well verify the account which ASP.NET is running as.
To do that, save the following code as "identity.aspx" and run it.

identity.aspx:
-------------------
<%@ Page Language="VB" %>
<%@ Import NameSpace = System.Security.Principal %>
<script runat="server">
Sub Page_Load()
Dim tmp As String = WindowsIdentity.GetCurrent.Name()
Label1.Text = "ASP.NET is running as the account : " & tmp
End Sub
</script>
<html>
<head>
<title>What account is ASP.NET running as ?</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:Label ID="Label1" Runat="server" Text="Label"></asp:Label>
</div>
</form>
</body>
</html>
------------

Running that script will return the configured ASP.NET account.

The above suggestions ONLY work if you're using the .Net Framework 2.0.
Make sure your virtual directory is configured to use it ( in the MMC's ASP.NET tab ).




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
Juan --

I ran the script you suggested, replacing the [MachineName] placeholder
text with my own computer's name. A whole list of stuff was displayed
(the names of the files that had permissions recursively applied to
them?), so I assume it worked, but is there a way to confirm or view
who has permission to access to GAC? When I view the
[\windows\assembly]'s properties (right-click folder > Properties), a
Security tab isn't present, so I'm guessing it's a special folder...

Anyway, I re-started IIS and tried to access my ASPX page again -- same
problem. Btw, while re-checking the Application log I noticed a
warning before the GAC errors occurred:

==========================================
Exception: System.IO.FileLoadException
Message: Could not load file or assembly 'System.Web, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its
dependencies. Access is denied.
==========================================

I'm not sure if that helps, or merely confirms that the problem is
related to GAC permissions, but I thought I'd post it just in case. I
don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?
I'm more than happy to reset any necessary settings... this is my dev
machine, after all.


-= Tek Boy =-

re:

The GAC is located in the directory : \windows\assembly.
Your ASP.NET identity doesn't have permission to read/execute the filesin the GAC

Did you change the ASP.NET identity from the default MachineName\ASPNET?
( for Windows XP installations... )

If you haven't changed the default identity ( by impersonating a different account... ),
you'll need to assign sufficient permissions to MachineName\ASPNET for that directory.

Warning :
You cannot use Windows Explorer to directly edit ACLs for this folder.

Instead, run the following command using your machine's name in place of MachineName:

cacls %windir%\assembly /e /t /p MachineName\ASPNET:R

That will assign, to your ASP.NET identity (MachineName\ASPNET),
the permissions needed to access the assemblies in the GAC.

If you are impersonating a different account, either change the impersonated account
to MachineName\ASPNET, or assign the permissions to the account you're using.

If you did change the impersonated account, you might also have to assign permission
to access, to that account, the directories listed in this MSDN article:

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

 

[Guest]

Yep. This is what I said in my first response, "This exception almost always
occurs when a web project is not configured as an IIS application."

If you have a web.config in a lower folder that ISN'T an IIS application,
that's the message you will get.
Peter


--
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com

Your description of impersonation is great. I've seen the term slung
around in many threads, but I always thought it had to do with
traditional ACL / security settings -- I didn't realize it was an
ASP.NET config file setting until just now. So thank you for that.

I just posted ( http://tinyurl.com/yh3als ) a reply to my original,
top-level cry for help. Long story short: I think the problem was that
I had another folder with ASPX code (and a Web.config file) nested
within the folder I was trying to compile. I'm guessing -- and please
correct me if I'm wrong -- that you can only have a Web.config file in
the root directory of the folder you're trying to compile, or the root
directory of folders that are set up as virtual directories (and
therefore have values for Application Name and Starting Point in IIS).

Does any of that make sense? I'm working backwards, trying to figure
out how things work based on when I encounter errors. You, OTOH, know
more about why things work they way they do, and I'm hoping you can
confirm or refute my ideas based on your experience.


-= Tek Boy =-

re:

I don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?

The script only assigned access permissions to MachineName\ASPNET
It doesn't change the default identity.

The only way to "reset" the impersonated account is to
manually change the impersonation web.config entry:

<identity impersonate="true" username="SomeAccount" password="P@ssw0rd" />

If you want to use the default configured account, eliminate that entry, or configure it as :

<identity impersonate = "false" />

Did you check to see that the directories listed at :
http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx
allow access to the machinename\ASPNET account ?

The easiest way to assign correct permissions to all required directories is to run :

aspnet_regiis -ga MachineName\ASPNET

from a command-line in the .Net Framework directory
( assuming that MachineName\ASPNET is the configured ASP.NET identity )

You may as well verify the account which ASP.NET is running as.
To do that, save the following code as "identity.aspx" and run it.

identity.aspx:
-------------------
<%@ Page Language="VB" %>
<%@ Import NameSpace = System.Security.Principal %>
<script runat="server">
Sub Page_Load()
Dim tmp As String = WindowsIdentity.GetCurrent.Name()
Label1.Text = "ASP.NET is running as the account : " & tmp
End Sub
</script>
<html>
<head>
<title>What account is ASP.NET running as ?</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:Label ID="Label1" Runat="server" Text="Label"></asp:Label>
</div>
</form>
</body>
</html>
------------

Running that script will return the configured ASP.NET account.

The above suggestions ONLY work if you're using the .Net Framework 2.0.
Make sure your virtual directory is configured to use it ( in the MMC's ASP.NET tab ).




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
Juan --

I ran the script you suggested, replacing the [MachineName] placeholder
text with my own computer's name. A whole list of stuff was displayed
(the names of the files that had permissions recursively applied to
them?), so I assume it worked, but is there a way to confirm or view
who has permission to access to GAC? When I view the
[\windows\assembly]'s properties (right-click folder > Properties), a
Security tab isn't present, so I'm guessing it's a special folder...

Anyway, I re-started IIS and tried to access my ASPX page again -- same
problem. Btw, while re-checking the Application log I noticed a
warning before the GAC errors occurred:

==========================================
Exception: System.IO.FileLoadException
Message: Could not load file or assembly 'System.Web, Version=2.0.0.0,
Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its
dependencies. Access is denied.
==========================================

I'm not sure if that helps, or merely confirms that the problem is
related to GAC permissions, but I thought I'd post it just in case. I
don't believe I changed the ASP.NET default identity, but just in
case, is there a way to reset it -- or is that what your script did?
I'm more than happy to reset any necessary settings... this is my dev
machine, after all.


-= Tek Boy =-

re:
Failed to execute the request because the ASP.NET process identity does
not have read permissions to the global assembly cache. Error:
0x80070005 Access is denied.
I've heard of the GAC, but I don't know enough about it to fix my
problem, or even know where to start.

The GAC is located in the directory : \windows\assembly.
Your ASP.NET identity doesn't have permission to read/execute the files in the GAC

Did you change the ASP.NET identity from the default MachineName\ASPNET ?
( for Windows XP installations... )

If you haven't changed the default identity ( by impersonating a different account... ),
you'll need to assign sufficient permissions to MachineName\ASPNET for that directory.

Warning :
You cannot use Windows Explorer to directly edit ACLs for this folder.

Instead, run the following command using your machine's name in place of MachineName:

cacls %windir%\assembly /e /t /p MachineName\ASPNET:R

That will assign, to your ASP.NET identity (MachineName\ASPNET),
the permissions needed to access the assemblies in the GAC.

If you are impersonating a different account, either change the impersonated account
to MachineName\ASPNET, or assign the permissions to the account you're using.

If you did change the impersonated account, you might also have to assign permission
to access, to that account, the directories listed in this MSDN article :

http://msdn2.microsoft.com/en-us/library/kwzs111e.aspx




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
I didn't have to touch IIS when I first wrote and ran the scripts the
first time around, but I'll give this a shot, anyway.

How do I configure a web project as an IIS application? I'm running
Windows XP Professional, so I can only have one IIS "web site". I
tried setting up a virtual directory beneath the default web site that
pointed to the folder where my code lives, and made sure the "Virtual
Directory > Application Settings > Application name" field in IIS had a
value (it does). When I tried to access the application
(http://localhost:99/tinkering/FirstPage.aspx), I get the following
error:

==========================================
Server Application Unavailable

The web application you are attempting to access on this web server is
currently unavailable. Please hit the "Refresh" button in your web
browser to retry your request.

Administrator Note: An error message detailing the cause of this
specific request failure can be found in the application event log of
the web server. Please review this log entry to discover what caused
this error to occur.
==========================================


So I went ahead and opened up the "Event Viewer > Application" window,
where I saw the following detailed error message:

==========================================
Failed to execute the request because the ASP.NET process identity does
not have read permissions to the global assembly cache. Error:
0x80070005 Access is denied.
==========================================


I've heard of the GAC, but I don't know enough about it to fix my
problem, or even know where to start.


-= Tek Boy =-


Peter wrote:
This exception almost always occurs when a web project is not configured as
an IIS application.
Peter

--
Co-founder, Eggheadcafe.com developer portal:
http://www.eggheadcafe.com
UnBlog:
http://petesbloggerama.blogspot.com




:

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Juan T. Llibre]

re:

Are Web.config files only allowed in virtual directory and IIS website root directories?

You can include a web.config file in every directory you have in your app.

The only warning is that you can't include MachineToApplication configurations
in web.config files in directories which haven't been configured as virtual directories.




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

Ok, I've made a bit of progress. Before I go into the explanation,
here's my directory structure:

C:\...\tinkering\ (set up as a virtual directory:
http://localhost/tinkering/)
======================================================
\tinkering\GeneralFunctionsAttempt01\
\tinkering\GeneralFunctionsAttempt01\Default.aspx
\tinkering\GeneralFunctionsAttempt01\Default.aspx\Default.aspx.cs
\tinkering\GeneralFunctionsAttempt01\Web.config
\tinkering\FirstPage.aspx
\tinkering\FirstPage.aspx\FirstPage.aspx.cs
\tinkering\Global.asax
\tinkering\Tinkering.sln
\tinkering\Web.config
======================================================

I was trying to run the ASPX script at
http://localhost/tinkering/FirstPage.aspx, so I had opened the
directory in Visual Studio .NET 2005 (File > Open Web Site >
[C:\...\tinkering\] ). When I tried to compile everything (F5), errors
were raised. However, once I excluded
[\tinkering\GeneralFunctionsAttempt01\Web.config] from the project,
everything recompiled again. My guess is that I created the
[GeneralFunctionsAttempt01] project a few days ago, then created the
[FirstPage.aspx] project in the parent folder -- and that might have
caused problems.

Including [\tinkering\GeneralFunctionsAttempt01\Web.config] still
causes compiling [\tinkering] to fail. Are Web.config files only
allowed in virtual directory and IIS website root directories?


-= Tek Boy =-

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Guest]

Then I'm still fuzzy on how I'm making use of MachineToApplication
configurations. Here's the content of the
[\tinkering\GeneralFunctionsAttempt01\Web.config] file -- the file
that, if I exclude it from the project, allows me to recompile
successfully again.

[C:\...\tinkering\GeneralFunctionsAttempt01\Web.config]
===============================
<?xml version="1.0"?>
<configuration>
<appSettings>
<add key="pageTitlePrefix" value="[Testing.com]"/>
</appSettings>
<connectionStrings>
<add name="MasterDatabase" connectionString="[removed]"/>
</connectionStrings>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
</system.web>
</configuration>
===============================


And here's the Web.config file from the root folder I have opened in
VS.NET 2005:

[C:\...\tinkering\GeneralFunctionsAttempt01\Web.config]
===============================
<?xml version="1.0"?>
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
</system.web>
</configuration>
===============================


I don't see anything at all about MachineToApplication configurations
in either one of those files. Or am I still missing some central idea
here?


-= Tek Boy =-

re:

Are Web.config files only allowed in virtual directory and IIS website root directories?

You can include a web.config file in every directory you have in your app.

The only warning is that you can't include MachineToApplication configurations
in web.config files in directories which haven't been configured as virtual directories.




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

Ok, I've made a bit of progress. Before I go into the explanation,
here's my directory structure:

C:\...\tinkering\ (set up as a virtual directory:
http://localhost/tinkering/)
======================================================
\tinkering\GeneralFunctionsAttempt01\
\tinkering\GeneralFunctionsAttempt01\Default.aspx
\tinkering\GeneralFunctionsAttempt01\Default.aspx\Default.aspx.cs
\tinkering\GeneralFunctionsAttempt01\Web.config
\tinkering\FirstPage.aspx
\tinkering\FirstPage.aspx\FirstPage.aspx.cs
\tinkering\Global.asax
\tinkering\Tinkering.sln
\tinkering\Web.config
======================================================

I was trying to run the ASPX script at
http://localhost/tinkering/FirstPage.aspx, so I had opened the
directory in Visual Studio .NET 2005 (File > Open Web Site >
[C:\...\tinkering\] ). When I tried to compile everything (F5), errors
were raised. However, once I excluded
[\tinkering\GeneralFunctionsAttempt01\Web.config] from the project,
everything recompiled again. My guess is that I created the
[GeneralFunctionsAttempt01] project a few days ago, then created the
[FirstPage.aspx] project in the parent folder -- and that might have
caused problems.

Including [\tinkering\GeneralFunctionsAttempt01\Web.config] still
causes compiling [\tinkering] to fail. Are Web.config files only
allowed in virtual directory and IIS website root directories?


-= Tek Boy =-

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Guest]

Juan --

So we're saying the same thing, then? That I'll run into problems if I
include Web.config in any directory besides the root, AND has not been
configured as a virtual directory? And _that_ is what the
MachineToApplication error indicates?


-= Tek Boy =-

re:

Are Web.config files only allowed in virtual directory and IIS website root directories?

You can include a web.config file in every directory you have in your app.

The only warning is that you can't include MachineToApplication configurations
in web.config files in directories which haven't been configured as virtual directories.




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

Ok, I've made a bit of progress. Before I go into the explanation,
here's my directory structure:

C:\...\tinkering\ (set up as a virtual directory:
http://localhost/tinkering/)
======================================================
\tinkering\GeneralFunctionsAttempt01\
\tinkering\GeneralFunctionsAttempt01\Default.aspx
\tinkering\GeneralFunctionsAttempt01\Default.aspx\Default.aspx.cs
\tinkering\GeneralFunctionsAttempt01\Web.config
\tinkering\FirstPage.aspx
\tinkering\FirstPage.aspx\FirstPage.aspx.cs
\tinkering\Global.asax
\tinkering\Tinkering.sln
\tinkering\Web.config
======================================================

I was trying to run the ASPX script at
http://localhost/tinkering/FirstPage.aspx, so I had opened the
directory in Visual Studio .NET 2005 (File > Open Web Site >
[C:\...\tinkering\] ). When I tried to compile everything (F5), errors
were raised. However, once I excluded
[\tinkering\GeneralFunctionsAttempt01\Web.config] from the project,
everything recompiled again. My guess is that I created the
[GeneralFunctionsAttempt01] project a few days ago, then created the
[FirstPage.aspx] project in the parent folder -- and that might have
caused problems.

Including [\tinkering\GeneralFunctionsAttempt01\Web.config] still
causes compiling [\tinkering] to fail. Are Web.config files only
allowed in virtual directory and IIS website root directories?


-= Tek Boy =-

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-

 

[Juan T. Llibre]

Just remove :

<compilation debug="true"/>
<authentication mode="Windows"/>

from \tinkering\GeneralFunctionsAttempt01\Web.config

\tinkering\GeneralFunctionsAttempt01 will inherit those settings from the root web.config.



Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================
Then I'm still fuzzy on how I'm making use of MachineToApplication
configurations. Here's the content of the
[\tinkering\GeneralFunctionsAttempt01\Web.config] file -- the file
that, if I exclude it from the project, allows me to recompile
successfully again.

[C:\...\tinkering\GeneralFunctionsAttempt01\Web.config]
===============================
<?xml version="1.0"?>
<configuration>
<appSettings>
<add key="pageTitlePrefix" value="[Testing.com]"/>
</appSettings>
<connectionStrings>
<add name="MasterDatabase" connectionString="[removed]"/>
</connectionStrings>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
</system.web>
</configuration>
===============================


And here's the Web.config file from the root folder I have opened in
VS.NET 2005:

[C:\...\tinkering\GeneralFunctionsAttempt01\Web.config]
===============================
<?xml version="1.0"?>
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<compilation debug="true"/>
<authentication mode="Windows"/>
</system.web>
</configuration>
===============================


I don't see anything at all about MachineToApplication configurations
in either one of those files. Or am I still missing some central idea
here?


-= Tek Boy =-

re:

Are Web.config files only allowed in virtual directory and IIS website root directories?

You can include a web.config file in every directory you have in your app.

The only warning is that you can't include MachineToApplication configurations
in web.config files in directories which haven't been configured as virtual directories.




Juan T. Llibre, asp.net MVP
asp.net faq : http://asp.net.do/faq/
foros de asp.net, en español : http://asp.net.do/foros/
===================================

Ok, I've made a bit of progress. Before I go into the explanation,
here's my directory structure:

C:\...\tinkering\ (set up as a virtual directory:
http://localhost/tinkering/)
======================================================
\tinkering\GeneralFunctionsAttempt01\
\tinkering\GeneralFunctionsAttempt01\Default.aspx
\tinkering\GeneralFunctionsAttempt01\Default.aspx\Default.aspx.cs
\tinkering\GeneralFunctionsAttempt01\Web.config
\tinkering\FirstPage.aspx
\tinkering\FirstPage.aspx\FirstPage.aspx.cs
\tinkering\Global.asax
\tinkering\Tinkering.sln
\tinkering\Web.config
======================================================

I was trying to run the ASPX script at
http://localhost/tinkering/FirstPage.aspx, so I had opened the
directory in Visual Studio .NET 2005 (File > Open Web Site >
[C:\...\tinkering\] ). When I tried to compile everything (F5), errors
were raised. However, once I excluded
[\tinkering\GeneralFunctionsAttempt01\Web.config] from the project,
everything recompiled again. My guess is that I created the
[GeneralFunctionsAttempt01] project a few days ago, then created the
[FirstPage.aspx] project in the parent folder -- and that might have
caused problems.

Including [\tinkering\GeneralFunctionsAttempt01\Web.config] still
causes compiling [\tinkering] to fail. Are Web.config files only
allowed in virtual directory and IIS website root directories?


-= Tek Boy =-

A day or two ago, I wrote a quick ASPX page with a CS codebehind using
Visual Studio .NET 2005 -- it worked, I saved it and closed the
project. Today, I came back to the project, reopened the solution, and
was greeted with the following error:

========================================================================
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.
========================================================================

I did some searching on Google, and all of the solutions to this
problem involved tweaking IIS. The thing is, I didn't have to touch
IIS when I wrote, compiled and ran the ASPX the first time around --
why would I have to do it during a subsequent visit?

If anybody has any suggestions on how to resolve this problem, I would
greatly like to hear them. Thanks in advance!


-= Tek Boy =-