.NET Core publishing to IIS problems - 403.14

Question

I am trying to publish a Core 1.0 app to a 2012R2 box that runs fine locally in IIS Express.

• Installed DotNetCore.1.0.0-WindowsHosting.exe on server
• Installed httpPlatformHandler_amd64.msi
• Set app pool to have 'no managed code'
• published from VS using 'Web Deploy'
• Latest VS Core Tools as of this writing

All I get is:

HTTP Error 403.14 - Forbidden

The Web server is configured to not list the contents of this directory.

In this article from Microsoft it only mentions that a 403.14 Forbidden error is created by picking the wrong directory for the site... which is not the case.

VS does NOT pusblish the web.config, however. And there is no choice for 'copy to server always' or 'content' (in DDL), both choices are missing.

Solution 1

Make sure that the service account / user credentials set on the application pool has access to run / access the app. That was my issue when deploying to IIS a few times.

As for including the web.config, make sure to include the following code in your project.json file. Just specify what you want to include in the publish.

"publishOptions": {
  "include": [
    "wwwroot",
    "Views",
    "appsettings.json",
    "web.config"
  ]
}

Solution 2

Check if there is web.config in your application's folder. If there is no web.config in the folder IIS don't know it's an ASP.NET Core application, it thinks you are trying listing the file in that folder. So if you set IsTransformWebConfigDisabled property in the project configuration to true, which caused Web.config file isn't generated in the publish folder when build it. So Change the IsTransformWebConfigDisabled property to false in YourProjectName.csproj file like this:-

<IsTransformWebConfigDisabled>false</IsTransformWebConfigDisabled>

Comments

[Beau D'Amore]

ok, how do I find out if the service account / user credentials set on the application pool has access to run / access the app? It is using ApplicationPoolIdentity. There are 30+ other sites running fine on this server, fyi.

[aholtry]

If you are using the 'Authorize' attribute in any of your controllers then you need to make sure that that user or group is listed in the identity of the application pool. You can set this in IIS under Application Pools -> Advanced Settings -> Identity

[Beau D'Amore]

I don't understand what you mean. 'The user or group'... do you mean the person logging in? It doesn't make sense because only one account can be the app pool identity... I guess I am not getting what you're saying... "is listed in the identity of the app pool'... you mean those users under some AD group??

[aholtry]

Correct, if they belong to an AD group then I would use the service account associated with that group as the Identity for the application pool. An easier example would be a single user. Just use their credentials for the Authorize in the controller as well as the identity in the Application Pool.

[Beau D'Amore]

The app pool identity can only be one of four things, LocalService, LocalSystem, NetworkService, ApplicationPoolIdentity.... I think we're not on the same page... thanks for your help though.

[aholtry]

Those are the built in accounts. Do you not have the option for Custom account? That is where you can specify your own account. I will post a picture of it in my answer above.

[aholtry]

Either way, I'm sorry I wasn't more helpful and I hope you get the answer you need soon.

[aholtry]

I just ran into the 403 error again myself and it turns out I was publishing to the wrong folder. So an empty folder will produce a 403 error. Just FYI

[Beau D'Amore]

I'm publishing to the right spot, just isn't working. I scrapped it. Started a fresh project with the latest core 1.0 refs, moved all the classes over, touched it up so it works with the newer libraries, fired it up fine... and STILL...CAN'T.... PUBLISH......

[aholtry]

Is your application pool running? And is your site running? They both need to be running.

[Beau D'Amore]

this isn't publishing an 'approot' folder anymore either.. just blobing it all in one folder above wwwroot

[Beau D'Amore]

I'm an idiot... I moved the IIS root folder to teh parent directory above wwwroot and now I get 'oops 500 internal server error' which means it started but had an error... thanks

[aholtry]

That's great news, sometimes we just need to talk it out. Nice work and I hope you keep having better luck.

[Martin]

The web.config file is generated when you run dotnet publish --configuration Release, if you are missing that file you are most likely not running the dotnet publish command.