Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have a SharePoint project which using claims based authenticate. It works well on our development, but fail on client DEV/UAT environment. Here are what we have done:

  1. The SharePoint service account had been security harden.
  2. We created the web application (www1) with claims-based.

    • When page first requested, it return assembly not found "Microsoft.Practices.EnterpriseLibrary.Validation", although we double checked our project DID NOT use this lib, and even if we include them into WSP (deploy to GAC)
    • Then we tried to put all those Microsoft.Practices.EnterpriseLibrary.* to bin folder of the web application, and then that errors gone. But it returns another access denied error when accessing an external configuration file, with error log here:

      Application error when access /_layouts/settings.aspx, Error=Access to the path 'C:\inetpub\wwwroot\wss\VirtualDirectories\uat.mydomain.com80\custom.external.config' is denied. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share) at System.Configuration.Interna... a1b76637-120b-4633-a378-15933a2c3b75

    • We tried to temporary disable anonymous authentication in IIS of the web application, the site can load successfully EXCEPT all SharePoint default style sheet/javascript/images are returning 403 access denied.

  3. We create another web application (www2) with classic mode, same solution/content db deploy. It works perfect.
  4. We create another web application (www3) with claims-base, and created new site collection with teamsite template.

    • It returns 403 when page load
    • We cannot even access /_login/default.aspx, but the error is

      Access Denied for /. StackTrace: at Microsoft.SharePoint.Utilities.SPUtility.HandleAccessDenied(HttpContext context) at Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModule.OnEndRequest(Object sender, EventArgs args) at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) at System.Web.HttpApplication.PipelineStepManager.ResumeSteps(Exception error) at System.Web.HttpApplication.BeginProcessRequestNotification(HttpContext context, AsyncCallback cb) at System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) at System.Web.Hosting.PipelineRuntime.ProcessRequestN..

  5. We temporary granted the SharePoint service account to local administrative right for tracing the problem, the symptoms are about the same.

We suspected the cause is from the permission hardening of the service account. but we don't know which permissions are missing.

Thanks a lot.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.