Recently, whilst doing some work for a customer, I came across an authentication issue which generated a 403 error which was hard to track down because there seemed to be no pattern, other than the issue seemed to revolve around permissions for users. It also seemed to happen at a certain time of day (first thing in the morning). The MOSS service account did not have this problem!
A recent email message from Daren Kovacevic from Co-operative Bulk Handling, in Perth gave me the clue as to what might be causing the problem. He was having a similar issue that he had resolved. It revolved around the Recycling of the IIS worker process. This setting is in IIS on the App Pool properties. For the default web it always set to 1:43 am. Daren’s theory was that the App Pool was recycled requiring the MOSS service account to re-authenticate. Normal users could not do this!
Armed with this new information I did a bit of experimentation. I found that I could duplicate the problem at will by doing the following:
-
Recycle the IIS App pool for the SharePoint web by using IIS manager (removing the Recycle worker process time, clicking Apply and then re-adding the Recycle setting i.e. set to recycle at 1:43am)
-
Sign in to INTRANET using a normal user account
-
Click on the users’ MySite link
-
Clicking on Site Settings for the MySite generates a 403 error!
-
I then restart the browser and login to SharePoint Site using the application pool account.
-
I click on MySite
-
I Click on Site Settings. No error!
-
I then go back to the SharePoint site and login as the normal SharePoint user.
-
I click on MySIte
-
I click on Site Settings and lo and behold no error!
To get a bit more information to try to resolve the issue, I then turned on SharePoint Verbose Logging:
-
Start SharePoint Central Admin -> Operations -> Diagnostic Logging (Logging and Reporting).
-
Select the All category in Event Throttling.
-
Set Least Critical for the event log to NONE
-
Set Least Critical for the TRACE log to VERBOSE.
-
Click OK to apply the settings.
Remember to set things back to the way they were, since the log files grow very quickly! I have also found that there is a bug in this area, in that if you reset the settings back to normal, they do not take effect until you do an IISRESET (be warned!).
I then went through the procedure above to generate the error. I turned off the verbose logging, and then made a copy of the most recent SharePoint log (remember they get recycled) and then did an IISRESET.
Looking at the log I noticed that an Access Denied was being generated when trying to access the layouts.sitemap file which is found in the _app_bin folder of the SharePoint web site.
Ex.
Application error when access /_layouts/people.aspx, Error=Access to the path 'C:\Inetpub\wwwroot\wss\VirtualDirectories\intranet80\_app_bin\layouts.sitemap' is denied.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights,
Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options,
SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy)
at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share)
at System.Web.Hosting.MapPathBasedVirtualFile.Open()
at System.Web.XmlSiteMapProvider.BuildSiteMap()
I then looked at the security on this file. It had READ ACCESS for the WSS_WPS localgroup which includes the app pool account. I deduced that Authenticated Users needed Read Access to the file. Once I did this, the problem went away. Happy days!