Following the instructions in this questions I can successfully change the permissions for the application pool identity
However, after I publish the web app...
The application pool identity's has been reset to just Read
How can I give the application pool identity full permissions even after I re-publish the web app? The same behavior also occurs if I give IUSR full permissions.
As far as I know, if you use Web Deploy from Visual Studio, the publish will overwrite the ACLs on the server by clearing them to the inherited defaults of the parent.
To avoid update ACL each time when you publish your web application.
You could try to add below command in your PublishProfiles's pubxml.
<IncludeSetAclProviderOnDestination>False</IncludeSetAclProviderOnDestination>
Details publish profile as below:
<?xml version="1.0" encoding="utf-8"?>
<!--
This file is used by the publish/package process of your Web project. You can customize the behavior of this process
by editing this MSBuild file. In order to learn more about this please visit https://go.microsoft.com/fwlink/?LinkID=208121.
-->
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup>
<WebPublishMethod>MSDeploy</WebPublishMethod>
<LastUsedBuildConfiguration>Release</LastUsedBuildConfiguration>
<LastUsedPlatform>Any CPU</LastUsedPlatform>
<SiteUrlToLaunchAfterPublish />
<LaunchSiteAfterPublish>True</LaunchSiteAfterPublish>
<ExcludeApp_Data>False</ExcludeApp_Data>
<MSDeployServiceURL>http://localhost:9825/</MSDeployServiceURL>
<DeployIisAppPath>WebFormApplication</DeployIisAppPath>
<RemoteSitePhysicalPath />
<SkipExtraFilesOnServer>True</SkipExtraFilesOnServer>
<MSDeployPublishMethod>InProc</MSDeployPublishMethod>
<EnableMSDeployBackup>False</EnableMSDeployBackup>
<UserName />
<_SavePWD>False</_SavePWD>
<IncludeSetAclProviderOnDestination>False</IncludeSetAclProviderOnDestination>
<PublishDatabaseSettings>
<Objects xmlns="">
<ObjectGroup Name="DefaultConnection" Order="1" Enabled="False">
<Destination Path="" />
<Object Type="DbCodeFirst">
<Source Path="DBContext" DbContext="WebFromIdentityTest.Models.ApplicationDbContext, WebFromIdentityTest" Origin="Configuration" />
</Object>
</ObjectGroup>
</Objects>
</PublishDatabaseSettings>
</PropertyGroup>
<ItemGroup>
<MSDeployParameterValue Include="$(DeployParameterPrefix)DefaultConnection-Web.config Connection String" />
</ItemGroup>
</Project>
Then you will find the permission will not be changed after you publish the application.
Related
I have tried about twenty solutions I have found online on how to prevent appsettings.{somevalue}.json from being published with the wrong environment. Basically I have a "development" variant and "production" variant and both are set to Copy If Newer under properties in the project. I have 2 publish profiles publishing a Worker Service app to a remote directory, one for debug configuration to my development environment (where the DOTNET_ENVIRONMENT is set to Development) and one to a similar production environment. I want to exclude the opposite environments config file from the publish or build automatically. Simple solution is to delete the file myself, however I want to make sure this is automated when published. Part of the issue is the complete lack of information on what goes in these pubxml files or csproj file that allows you to remove or delete files. Other questions on stack exchange have noted this lack of information as well.
Here is what I have recently tried and I have tried placing these blocks in both pubxml files and csproj file both inside and outside of the PropertyGroup node but none of these work:
1.
<Target Name="Debug" AfterTargets="AfterPublish">
<Message Text="Development Publish Message"></Message>
<Delete Files="appsettings.Production.json" />
</Target>
(I have also tried specifying variables for that json file's location as well as hardcoding its actual path in the final publish. This does nothing and that message isn't shown anywhere)
2.
<ItemGroup>
<Content Remove="appsettings.Production.json" />
</ItemGroup>
<ExcludeFilesFromDeployment>
bin\Debug\netcoreapp3.1\appsettings.Production.json;
</ExcludeFilesFromDeployment>
<ItemGroup>
<Content Update="appsettings.Production.json" CopyToPublishDirectory="Never" />
</ItemGroup>
(this one is straight from Microsoft but like many others, does nothing)
https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/visual-studio-publish-profiles?view=aspnetcore-6.0
<Choose>
<When Condition="'$(Configuration)' == 'Debug'">
<ItemGroup>
<None Include="appsettings.Production.json" CopyToOutputDirectory="Never" CopyToPublishDirectory="Never" />
</ItemGroup>
</When>
<When Condition="'$(Configuration)' == 'Release'">
<ItemGroup>
<None Include="appsettings.Development.json" CopyToOutputDirectory="Never" CopyToPublishDirectory="Never" />
</ItemGroup>
</When>
</Choose>
I could continue but nothing I have found works. Is this even possible?
Thanks!
I'm trying to get a docker image to run our on-premise Service Fabric cluster.
We've setup a service fabric cluster on our on-premise network, which seems to run fine (it already runs 2 docker images). I'm looking for one of my containers to run under a domain user (Service Account), so I can reach SMB shares in my network (which have been granted permission to the service account).
I'm getting the following error:
Error event: SourceId='System.Hosting', Property='Activation:1.0'.
There was an error during activation.Failed to setup ApplicationPrincipals. Error:ApplicationPrincipalAbortableError
Also shown as image:
The container I'm trying to run: https://hub.docker.com/r/stefanscherer/registry-windows/
ApplicationManifest.xml
<?xml version="1.0" encoding="utf-8"?>
<ApplicationManifest ApplicationTypeName="[REMOVED].ServiceFabric.WindowsContainerRegistryType"
ApplicationTypeVersion="1.0.0"
xmlns="http://schemas.microsoft.com/2011/01/fabric"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<Parameters>
<Parameter Name="WindowsContainerRegistry_InstanceCount" DefaultValue="-1" />
</Parameters>
<!-- Import the ServiceManifest from the ServicePackage. The ServiceManifestName and ServiceManifestVersion
should match the Name and Version attributes of the ServiceManifest element defined in the
ServiceManifest.xml file. -->
<ServiceManifestImport>
<ServiceManifestRef ServiceManifestName="WindowsContainerRegistryPkg" ServiceManifestVersion="1.0.0" />
<ConfigOverrides />
<Policies>
<ContainerHostPolicies CodePackageRef="Code">
<!-- See https://aka.ms/I7z0p9 for how to encrypt your repository password -->
<RepositoryCredentials AccountName="" Password="" PasswordEncrypted="false" />
<PortBinding ContainerPort="5000" EndpointRef="WindowsContainerRegistryTypeEndpoint" />
<Volume Source="\\[REMOVED]\ServiceFabricShare" Destination="C:\registry" IsReadOnly="false"></Volume>
</ContainerHostPolicies>
</Policies>
</ServiceManifestImport>
<DefaultServices>
<!-- The section below creates instances of service types, when an instance of this
application type is created. You can also create one or more instances of service type using the
ServiceFabric PowerShell module.
The attribute ServiceTypeName below must match the name defined in the imported ServiceManifest.xml file. -->
<Service Name="WindowsContainerRegistry" ServicePackageActivationMode="ExclusiveProcess">
<StatelessService ServiceTypeName="WindowsContainerRegistryType" InstanceCount="[WindowsContainerRegistry_InstanceCount]">
<SingletonPartition />
</StatelessService>
</Service>
</DefaultServices>
<Principals>
<Users>
<User Name="ServiceFabricAppl" AccountType="DomainUser" AccountName="[REMOVED]\appl_ServiceFabric" Password="[REMOVED]" PasswordEncrypted="false" />
</Users>
</Principals>
<Policies>
<DefaultRunAsPolicy UserRef="ServiceFabricAppl" />
</Policies>
</ApplicationManifest>
P. S. I'm working with an unencrypted password just for testing purposes to make sure this isn't the problem right now.
ServiceManifest.xml
<?xml version="1.0" encoding="utf-8"?>
<ServiceManifest Name="WindowsContainerRegistryPkg"
Version="1.0.0"
xmlns="http://schemas.microsoft.com/2011/01/fabric"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ServiceTypes>
<!-- This is the name of your ServiceType.
The UseImplicitHost attribute indicates this is a guest service. -->
<StatelessServiceType ServiceTypeName="WindowsContainerRegistryType" UseImplicitHost="true">
<Extensions>
<Extension Name="Traefik">
<Labels xmlns="http://schemas.microsoft.com/2015/03/fabact-no-schema">
<Label Key="traefik.frontend.rule">Host:registry.windows.containers.[REMOVED].com</Label>
<Label Key="traefik.enable">true</Label>
<Label Key="traefik.frontend.passHostHeader">true</Label>
<!--<Label Key="traefik.port">5000</Label>
<Label Key="traefik.protocol">http</Label>
<Label Key="traefik.frontend.entryPoints">http,https</Label>
<Label Key="traefik.frontend.headers.referrerPolicy">no-referrer</Label>-->
</Labels>
</Extension>
</Extensions>
</StatelessServiceType>
</ServiceTypes>
<!-- Code package is your service executable. -->
<CodePackage Name="Code" Version="1.0.0">
<EntryPoint>
<!-- Follow this link for more information about deploying Windows containers to Service Fabric: https://aka.ms/sfguestcontainers -->
<ContainerHost>
<ImageName>stefanscherer/registry-windows:2.6.2-2016</ImageName>
</ContainerHost>
</EntryPoint>
<!-- Pass environment variables to your container: -->
<!--
<EnvironmentVariables>
<EnvironmentVariable Name="VariableName" Value="VariableValue"/>
</EnvironmentVariables>
-->
</CodePackage>
<!-- Config package is the contents of the Config directoy under PackageRoot that contains an
independently-updateable and versioned set of custom configuration settings for your service. -->
<ConfigPackage Name="Config" Version="1.0.0" />
<Resources>
<Endpoints>
<!-- This endpoint is used by the communication listener to obtain the port on which to
listen. Please note that if your service is partitioned, this port is shared with
replicas of different partitions that are placed in your code. -->
<Endpoint Name="WindowsContainerRegistryTypeEndpoint" Port="5000" />
</Endpoints>
</Resources>
</ServiceManifest>
Sources:
https://learn.microsoft.com/en-us/azure/service-fabric/service-fabric-run-service-as-ad-user-or-group
Service fabric local cluster error (this one didn't offer any solution for me unfortunately)
I am new with ASP.NET, just tried to deploy a default web site - nothing special, but got a error:
An error occurred during publish.
Exception calling ".ctor" with "1" argument(s): "Invalid URI: The format of the URI could not be determined.
Project:
Deployments settings:
MySuperSite.pubxml:
<?xml version="1.0" encoding="utf-8"?>
<!--
This file is used by the publish/package process of your Web project. You can customize the behavior of this process
by editing this MSBuild file. In order to learn more about this please visit http://go.microsoft.com/fwlink/?LinkID=208121.
-->
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup>
<WebPublishMethod>MSDeploy</WebPublishMethod>
<LastUsedBuildConfiguration>Release</LastUsedBuildConfiguration>
<LastUsedPlatform>Any CPU</LastUsedPlatform>
<SiteUrlToLaunchAfterPublish>http://localhost/MySuperSite</SiteUrlToLaunchAfterPublish>
<LaunchSiteAfterPublish>True</LaunchSiteAfterPublish>
<ExcludeApp_Data>False</ExcludeApp_Data>
<PublishFramework />
<UsePowerShell>True</UsePowerShell>
<EnableMSDeployAppOffline>True</EnableMSDeployAppOffline>
<MSDeployServiceURL>localhost</MSDeployServiceURL>
<DeployIisAppPath>Default Web Site/MySuperSite</DeployIisAppPath>
<RemoteSitePhysicalPath />
<SkipExtraFilesOnServer>True</SkipExtraFilesOnServer>
<MSDeployPublishMethod>InProc</MSDeployPublishMethod>
<EnableMSDeployBackup>False</EnableMSDeployBackup>
<UserName />
<_SavePWD>False</_SavePWD>
</PropertyGroup>
</Project>
can you remove the following from the project.json file and see if it works.
"commands": {
"web": "Microsoft.AspNet.Hosting --server Microsoft.AspNet.Server.Kestrel --server.urls=http://*:5000/"
},
I've been examining the event logs for the WebApp I'm trying to automatically deploy and the only problem I can find is this (Azure event log):
An unhandled exception occurred. Type: System.IO.DirectoryNotFoundException Process ID: 1784
Process Name: WaIISHost
Thread ID: 1
AppDomain Unhandled Exception for role Website_IN_0
Exception: Could not find a part of the path 'E:\approot'.
So I have a poke and sure enough, nothing lives there and the directory doesn't even exist. However I then realise the site exists in E:\sitesroot.... so why is it looking in approot?
This is my service definition:
<?xml version="1.0" encoding="utf-8"?>
<ServiceDefinition name="WebsiteAzure" xmlns="etc">
<WebRole name="Website" vmsize="Small">
<Sites>
<Site name="Web">
<Bindings>
<Binding name="Endpoint1" endpointName="Endpoint1" />
</Bindings>
</Site>
</Sites>
<Endpoints>
<InputEndpoint name="Endpoint1" protocol="http" port="80" />
</Endpoints>
<Imports>
<Import moduleName="Diagnostics" />
</Imports>
</WebRole>
</ServiceDefinition>
Is that right?
For the record the deployment works fine with visual studio but i'm trying to automate with powershell which is where I'm getting the issue. I'm pretty sure it has all the .dlls it requires and the config and definition are correct so why is it choking on this directory?
I would suggest using New-AzureServiceProject and add-azure*webrole to scaffold the project locally, and using Publish-AzureServiceProject to package and publish to Azure.
I want to copy an ASP.NET MVC website to a remote IIS 7 server using WebDAV. I have created a site in IIS, enabled WebDAV and assigned a special application pool I have named "WebDAV Application Pool". Using a Windows 7 or Vista client I'm able to mount the remote site as a network drive. So far, so good.
However, I have problems uploading web.config files to the remote site. One problem is that as soon as a web.config has been uploaded it is used to configure the WebDAV site. The web.config file in a Views folder of a MVC project effectively blocks access to that folder.
To work around this problem I have configured the application pool in the applicationHost.config file:
<configuration>
<applicationPools>
<add name="WebDAV Application Pool"
autoStart="true"
enableConfigurationOverride="false" />
</applicationPools>
</configuration>
The interesting part is the 'enableConfigurationOverride` attribute:
When true, indicates that delegated settings in Web.config files will processed for applications within this application pool. When false, all settings in Web.config files will be ignored for this application pool.
Doing this makes it possible to upload a web.config file to the Views folder without breaking access to the folder.
However, I'm still unable to upload a web.config file to the root folder. I have the following settings in the applicationHost.config file to ensure that request filtering doesn't interfere with WebDAV:
<configuration>
<location path="webdav.mysite.tld">
<system.webServer>
<security>
<requestFiltering>
<fileExtensions applyToWebDAV="false" />
<verbs applyToWebDAV="false" />
<hiddenSegments applyToWebDAV="false" />
</requestFiltering>
</security>
</system.webServer>
</location>
</configuration>
In particular hiddenSegments will normally block access to web.config but setting the applyToWebDAV attribute to false should ensure that this file isn't blocked when using WebDAV.
Unfortunately, I'm still unable to copy my web.config file to the root folder of the site. Doing drag and drop in Windows Explorer to the mapped WebDAV network drive will result in the following error message:
Error 0x80070057: The parameter is incorrect.
On the wire it seems that the HTTP status 400 Bad Request is returned.
Is there anything I can do to configure WebDAV on IIS 7 to avoid this problem?
Followup
Currently I'm unable to reproduce the problem I described above. Perhaps I had to restart something or some other unknown factor fixed my problem. The bottom line is that I now can publish a web site using WebDAV.
1) Open up %windir%\system32\inetsrv\config\schema\WEBDAV_schema
2) Add the following inside of the configSchema section
<sectionSchema name="system.codedom">
<element name="compilers">
<collection addElement="compiler" removeElement="remove" clearElement"clear">
<attribute name="language" type="string" isCombinedKey="true"/>
<attribute name="extension" type="string" isCombinedKey="true"/>
<attribute name="type" type="string"/>
<attribute name="warningLevel" type="int"/>
<collection addElement="providerOption">
<attribute name="name" type="string" isUniqueKey="true"/>
<attribute name="value" type="string"/>
</collection>
</collection>
</element>
</sectionSchema>