We have a SharePoint project which using claims based authenticate. It works well on our development, but fail on client DEV/UAT environment. Here are what we have done:
- The SharePoint service account had been security harden.
We created the web application (www1) with claims-based.
- When page first requested, it return assembly not found "Microsoft.Practices.EnterpriseLibrary.Validation", although we double checked our project DID NOT use this lib, and even if we include them into WSP (deploy to GAC)
Then we tried to put all those Microsoft.Practices.EnterpriseLibrary.* to bin folder of the web application, and then that errors gone. But it returns another access denied error when accessing an external configuration file, with error log here:
Application error when access /_layouts/settings.aspx, Error=Access to the path 'C:\inetpub\wwwroot\wss\VirtualDirectories\uat.mydomain.com80\custom.external.config' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share) at System.Configuration.Interna... a1b76637-120b-4633-a378-15933a2c3b75
- We create another web application (www2) with classic mode, same solution/content db deploy. It works perfect.
We create another web application (www3) with claims-base, and created new site collection with teamsite template.
- It returns 403 when page load
We cannot even access /_login/default.aspx, but the error is
Access Denied for /. StackTrace: at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(HttpContext context) at Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.OnEndRequest(Object sender, EventArgs args) at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) at System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception error) at System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb) at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) at System.Web.Hosting.PipelineRuntime.ProcessRequestN..
We temporary granted the SharePoint service account to local administrative right for tracing the problem, the symptoms are about the same.
We suspected the cause is from the permission hardening of the service account. but we don't know which permissions are missing.
Thanks a lot.