YII framework permissions issue on IIS 7.5 server

Question

I have a Windows Server 2008 R2 machine with the IIS Web server role installed. I didn't check any of the tickboxes apart from the default selection for the install and IIS was downloaded and installed from php.iis.net using the Web Platform Installer.

I have copied the files for the site (Multicraft Control Panel) to wwwroot and navigated to localhost but recieve an error :

Application runtime path "C:\inetpub\wwwroot\panel\protected\runtime" is not valid. Please make sure it is a directory writable by the Web server process.

The folder it refers to exists and the IIS_IUSR has read/list/execute permissions. I guess this is, however, a permissions issue as if I set that whole wwwroot\panel folder to "everyone" and "full control" the page loads without issue. I would not want to use this setting though due to the security issue. I've gathered so far it could be due to something called the YII framework but still need help in which process or account(s) should be granted access to the folder.

score 3 · Answer 1 · answered Feb 15 '13 at 14:12

3

In IIS 7.5, the application pool for the default website runs as IIS AppPool\DefaultAppPool. If that's the account running your app pool, that's what you need to grant rights to. This is documented on IIS.net if you want to read further.

You can change that to any user account you want, and best practices are to run each application pool under a different identity, but that's probably a step for after you solve this first problem.

answered Feb 15 '13 at 14:12

MDMarra

100,183
32
195
326

I've read the IIS.net article and changed it to use the DefaultAppPool account. I had an issue with it not appearing in the list of account to grant permissions to which I solved with [this](http://serverfault.com/questions/81165/how-to-assign-permissions-to-applicationpoolidentity-account) SF question. DefaultAppPool now has full control over the folder but the error is still displayed. – tombull89 Feb 16 '13 at 14:14

score 2 · Accepted Answer · answered Feb 21 '13 at 11:47

It seems that IIS AppPool\DefaultAppPool was not the right account to set permissions on - with a lot of trial and error and using a page with php's get-current-user I found that the IUSR account also needs access to the wwwroot folder. I gave the IUSR acess to the folder - all but delete and full access - and it loaded the page fine.

YII framework permissions issue on IIS 7.5 server

2 Answers2