HAP 7 Installation Problem - AppPool

[enjay]

Hi Nick - I can't add the IIS AppPool\HAP to the permissions. I've selected the local machine, however note that in your video you are searching for "User, Group or Built-in security principal", whereas I just had "Built-in security principal". Any idea how to add the app pool?

[nickbro]

IIS6 or II7?

 

Try following http://www.codeplex.com/Download?ProjectName=hap&DownloadId=282513

[gavlar]

I also couldn't add the apppool permissions at first using the GUI, i had to do it from the cmd with icacls Icacls

[nickbro]

That is very odd, usually just making sure you type in the correct username (IIS AppPool\HAP) and make sure it's on the local server works, no searching, as searching doesn't find it

[enjay]

IIS7. The step in question (21 in your PDF file) is on the folder not IIS, though, or have I misunderstood it?

 

@gavlar - what was the command line you typed to add it?

[nickbro]

Not in IIS, in Explorer

[enjay]

That's what I thought - definitely can't add that user, possibly because I can only search on "built-in security principles" when searching the local computer - is there a way to change that, or some other security permissions which I could set instead of adding the IIS AppPool?

[nickbro]

This is what you should be looking at. You need to make sure you are remoted into the IIS Server, not trying to do it via another computer (i.e. \\chs03\wwwroot or \\chs03\c$\inetpub\wwwroot)

 

[ATTACH=CONFIG]11404[/ATTACH]

 

Just clicking OK on this will accept the username

[enjay]

Here's what I see, this is from the server itself, browsing to the folder via Computer > Local Disk (C:)

[nickbro]

How odd, you need to select users and groups from the available search objects

[enjay]

Can't - "built in security principals" is the only tick box in the list...

[nickbro]

How odd, is the server the PDC

[enjay]

Yes. PDC, S2008 R2, IIS7, logged in as a domain admin user.

[nickbro]

In that case, try searching the domain for it. If it still doesn't work one of the other members has some hints on how to do it via a cmd

[enjay]

Not in the domain either, I'll PM the other member and see how he did it...

[gavlar]

icacls C:\inetpub\wwwroot\Hap /grant "IIS AppPool\HAP":(RX)

[enjay]

Thanks Gavlar, I'll give that a try...

[enjay]

icacls C:\inetpub\wwwroot\Hap /grant "IIS AppPool\HAP":(RX)

Perfect, that worked a treat. Thanks!

[nickbro]

icacls C:\inetpub\wwwroot\Hap /grant "IIS AppPool\HAP":(RX)

 

Thanks @gavlar, I've posted this to the Home Access Plus&#43

[enjay]

Other points worth adding to the documentation would be deleting the endpoint lines at the end of the web.config - you posted that to someone on here, and I had it too, so it is unlikely we're the only two.

 

I also had the remove the line about svg MimeTypes, so if that is something wider then it would be worth documenting too.

 

Awesome app, by the way, not sure I've said that enough yet!!

[nickbro]

I'll add them to the documentation tab on codeplex tonight

[Carrot63]

Hi

I have tried the cacls command as described thanks and it sets permissions on the HAP folder but the HAP user is not shown anywhere lower down in the structure. I also had the original issue where I do not get the option to see user, group.. in the object type.

Edited October 14, 2011 by Carrot63
Question already answered

[nickbro]

See: Home Access Plus&#43

 

icacls C:\inetpub\wwwroot\Hap /grant "IIS AppPool\HAP":(RX)

 

Also

 

[ATTACH=CONFIG]11648[/ATTACH][ATTACH=CONFIG]11649[/ATTACH]

 

Notice I select the local server, and just type the name in, no going to Advanced...

 

If you are running this on a domain controller:

 

STOP!

 

1. can you run this on a member server?

a. If Yes, do so, HAP+ v7+ works best on a member server, although v6- works best on the PDC.

2. you need to enable interactive logons on the server. If your server is a Remote Desktop Server (which mine is), this is already set

3. If you insist on a PDC, make sure Buit-in security principals are selected to search in.

[Carrot63]

Hi

Presumably this version is not reliant in any way on easylink so I could install onto a member server as long as I created a new external dns mapping to that server ie HAP.kes.org.uk? Would you recommend doing it like this?

Thanks

[nickbro]

Yes, that would be a good thing. HAP+ has never relied on easylink since it was called Home Access Plus+. Back when it was CHS Extranet, it did have some ties, but that was over a year ago.

 

Best solution is:

 

Windows Server 2008 R2 acting as a remote desktop server (you can then use remote apps via remote desktop gateway, but that part is optional)

IIS7.5

Joined as a Member Server

Directory on website called HAP in which HAP is installed

Set up a DNS entry pointing to your server (hap.school.tld -> county issued ip -> reverse proxy or traffic routing -> your server, or hap.school.tld -> your external ip -> traffic route for 443 -> your server)

Acquire a SSL Certificate for hap.school.tld, (StartSSL offers free ssl certs)

Assign certificate to the IIS Website

Install quota service on servers you will be accessing for My Files

OPTIONAL: install SQL server, and create a database for the logon tracker database

Set the security on the HAP folder

Set additional rights on the APP_DATA folder

 

This is the setup I have for my HAP+. I also then use this server as a reverse proxy to relay traffic to our RM Server so management console can be accessed, as well as a backup for our exchanger server. (http://www.iis.net/download/ApplicationRequestRouting is the extension for IIS7 I use for that)