Error details authorization rules denied the access

This article helps you resolve the problem where FTP authorization rules aren’t inherited with user isolation setting if FTP user isolation is configured at the site-level.

Original product version: В Internet Information Services 7.5
Original KB number: В 4294477

Symptoms

In Microsoft Internet Information Services (IIS), if FTP user isolation is configured at the site-level to User name physical directory (enable global virtual directories), FTP authorization rules do not adhere to the physical path of the application and will not be inherited as per the folder structure.

Assume that an IIS FTP site has user isolation set to User name physical directory (enable global virtual directories), and in the FTP authorization feature, read permissions are granted to all users. A folder named Upload is created under FTPLocaluser , and read and write access is granted to all users through the FTP authorization feature in IIS for this Upload folder. Despite having write permissions to the Upload folder, when a user whose user name matches the folder in the path tries to upload a file in the Upload folder, the user receives an Access denied error message.

The output from trying to upload an FTP file through the command-line FTP utility that is included in Windows resembles the following:

Cause

This behavior is by design. The FTP user isolation User name physical directory (enable global virtual directories) setting ensures backward-compatibility with legacy IIS 6 functionality.

Resolution

To get the desired behavior, use another folder outside the user isolated folders, and then set the required FTP authorization rules on that folder. For FTP sites that use User name physical directory (enable global virtual directories) isolation, use the FTP/Upload path instead of FTP/LocalUser/ /Upload for setting the FTP authorization rules. The directory parser will ignore the part of the path for FTP/LocalUser/ /Upload because this is used for the isolation lookup. Therefore, the behavior will only work as expected when authorization rules are defined on paths outside the user isolated folders, such as the FTP/Upload example path. In this manner, authorization applies to the Upload folder for all users.

The following is a sample authorization rule in the ApplicationHost.config file:

When you try to upload a document to the FTP site that has this configuration, the output from the FTP command prompt utility in Windows resembles the following:

The User Isolation User name physical directory (enable global virtual directories) setting is inherited from IIS 6 and does not follow the correct folder structure. Another isolation mode, User name directory (disable global virtual directories), is present in IIS 7 and later versions, and this configuration does follow authorization rules.

Источник

Правила авторизации FTP не наследуются с параметром изоляции пользователей на FTP-сайтах в IIS

Эта статья поможет устранить проблему, из-за которой правила авторизации FTP не наследуются с параметром изоляции пользователя, если изоляция пользователей FTP настроена на уровне сайта.

Исходная версия продукта: Internet Information Services 7.5
Исходный номер базы знаний: 4294477

Симптомы

Если в Microsoft IIS (IIS) изоляция пользователей FTP настроена на уровне сайта на физический каталог имени пользователя (включение глобальных виртуальных каталогов), правила авторизации FTP не соответствуют физическому пути приложения и не будут наследоваться согласно структуре папок.

Предположим, что на ftP-сайте IIS для изоляции пользователей задан физический каталог имени пользователя (включение глобальных виртуальных каталогов ), а в функции авторизации FTP разрешения на чтение предоставляются всем пользователям. Папка с именем Upload FTPLocaluser создается в разделе , и доступ на чтение и запись предоставляется всем пользователям с помощью функции авторизации FTP в IIS для этой папки отправки . Несмотря на наличие разрешений на запись в папку «Отправка», в пути, пытается отправить файл в папку «Отправка», пользователь получает сообщение об ошибке «Отказано в доступе».

Результат отправки FTP-файла с помощью служебной программы FTP командной строки, включенной в Windows, выглядит следующим образом:

Причина

Такое поведение является особенностью данного продукта. Параметр ftP user isolation User name physical directory (enable global virtual directories) ( Включить глобальные виртуальные каталоги) обеспечивает обратную совместимость с устаревшими функциями IIS 6.

Решение

Чтобы получить требуемое поведение, используйте другую папку за пределами изолированных пользователем папок, а затем задайте необходимые правила авторизации FTP для этой папки. Для ftP-сайтов, использующих изоляцию физического каталога имени пользователя (включение глобальных виртуальных каталогов ), FTP/Upload FTP/LocalUser/ /Upload используйте путь вместо настройки правил авторизации FTP. Средство синтаксического анализа каталогов игнорирует FTP/LocalUser/ /Upload часть пути, так как она используется для поиска изоляции. Таким образом, поведение будет работать должным образом, только если правила авторизации определены в путях за пределами изолированных папок пользователя, FTP/Upload например в примере пути. Таким образом авторизация применяется к папке отправки для всех пользователей.

Ниже приведен пример правила авторизации вApplicationHost.configфайла .

При попытке отправить документ на FTP-сайт с такой конфигурацией выходные данные программы командной строки FTP в Windows выглядят следующим образом:

Параметр физического каталога user Isolation User name (включить глобальные виртуальные каталоги) наследуется от IIS 6 и не соответствует правильной структуре папок. Другой режим изоляции — каталог имен пользователей (отключение глобальных виртуальных каталогов) — присутствует в IIS 7 и более поздних версиях, и эта конфигурация соответствует правилам авторизации.

Источник

Error details authorization rules denied the access

This forum is closed. Thank you for your contributions.

Asked by:

Question

I am using windows 2008 r2 web edition with Microsoft ftp server 7.5.

I used website panel storefront to create new user with a hosting account. It was successful (well sort of, I need to fix some cashier issues and such, but I manually approved the invoice). with the user, I added a domain then created an ftp account. When I try to login to the ftp account I get the following message:

530-User cannot log in, home directory inaccessible.
Win32 error: Access is denied.
Error details: Authorization rules denied the access.
530 End
Login failed.

I followed the documentation as closely as possible and retraced the steps. Everything appears to be setup properly. I added WSPFtpUsers to inetpub/ftproot, i isolated the ftp, gave read writes to WSPFtpUsers while creating the ftp site.

Webpanel created the username folder under hostingspaces and I see the user has been added to the permissions.

Thanks in advance!

That’s exactly my problem too.

If you want temporary unsecure solution you have to set isolation to «User name directory», then all the other users will have read access to other virtual directories (if you enter correct name under the FTP root directory).

E.g. you have user «test1», virtaul directory «test1» is created by WSP under the FTP Default Site, and when you connect to FTP with test1 user you are redirected to that virtual directory: ./test1

If you go up you are in «./» (root dir), and if you have «test2» user and virtual directory, but connected with test1 you can enter within your FTP client «./test2» and you will have read access to test2 users root.

This is because WSP doesn’t create users virtual directories under the %ftproot%/LocalUser/%username%

Check under MS documentation: Isolate users. Restrict users to the following directory: User name directory (disable global virtual directories)

I really want to know how to isolate users and when will this be corrected in WSP?

Источник

Error details authorization rules denied the access

Answered by:

Question

I have been trying to set this up for a while now. I am trying to setup FTP virtual directories for isolationg user directories on Windows Server 2012. I am able to connect to the FTP site anonymously, but when I start adding virtual directories for specific user access, the user login returns status code:

530-User cannot log in, home directory inaccessible.
Win32 error: Access is denied.
Error details: Authorization rules denied the access.

What is odd is that I have set allow authorization rules for the user and have added the user to have read/write permissions on the virtual directory.

Any help with this would be greatly appreciated!

Answers

Just thougt I’d share a solution I have found for this. Turns out it was much simpler than what I had expected.

By creating FTP sites for each directory (that I had initially thought to setup as virtual directories), I have now been able to allow access to multiple users for multiple directories. Setup basic auth (like in Terri’s post) and set them up for each individual user (again, like Terri’s post). Only difference is that instead of using virutal directories on one FTP site, setup separate FTP sites where you would have setup virtual directories and point that FTP site to the directory that you wish to host/share. I am using hostnames for each site to separate them out.

Thanks for your help Terri. You helped me along the way to get to this solution!

Источник

Error details authorization rules denied the access

This forum is closed. Thank you for your contributions.

Asked by:

Question

I am using windows 2008 r2 web edition with Microsoft ftp server 7.5.

I used website panel storefront to create new user with a hosting account. It was successful (well sort of, I need to fix some cashier issues and such, but I manually approved the invoice). with the user, I added a domain then created an ftp account. When I try to login to the ftp account I get the following message:

530-User cannot log in, home directory inaccessible.
Win32 error: Access is denied.
Error details: Authorization rules denied the access.
530 End
Login failed.

I followed the documentation as closely as possible and retraced the steps. Everything appears to be setup properly. I added WSPFtpUsers to inetpub/ftproot, i isolated the ftp, gave read writes to WSPFtpUsers while creating the ftp site.

Webpanel created the username folder under hostingspaces and I see the user has been added to the permissions.

Thanks in advance!

That’s exactly my problem too.

If you want temporary unsecure solution you have to set isolation to «User name directory», then all the other users will have read access to other virtual directories (if you enter correct name under the FTP root directory).

E.g. you have user «test1», virtaul directory «test1» is created by WSP under the FTP Default Site, and when you connect to FTP with test1 user you are redirected to that virtual directory: ./test1

If you go up you are in «./» (root dir), and if you have «test2» user and virtual directory, but connected with test1 you can enter within your FTP client «./test2» and you will have read access to test2 users root.

This is because WSP doesn’t create users virtual directories under the %ftproot%/LocalUser/%username%

Check under MS documentation: Isolate users. Restrict users to the following directory: User name directory (disable global virtual directories)

I really want to know how to isolate users and when will this be corrected in WSP?

Источник