[Solved] Calling uxordre from a c# web service on same machine - uuxordre returns Access Deined - In

uuxordre returns Access Deined - Insufficient Priviliges.
Hi,
I have setup a C# web service to call uxordre.exe . My call is "d:\universe\conupr\exec\uxordre.exe UPR=JOB_ME501 MU=W_LEGASIS". When I execute the above-mentioned from the DOS command prompt , it works. However, when my web service tries the same call, it receives the message: "Access Denied - Insufficient Priviliges". I noticed that when the webservice is excuting other tasks , the Windows task manager indicates the user as NETWORK SERVICE .The web service can run other executables on the machine without any problems. I have set the security permissions on the Dollar Universe folder for the user "NETWORK SERVICE" to full control. Dollar Universe has been set up to use the user "production". I have tried to make the webservice use impersonation of the "production" account to no avail. Someone suggested that I must call uxsetenv.bat, then call uxordre.exe, but it had no effect. Is there a setting that I must set to allow the account "NETWORK SERVICE" to run uxordre. My platform is Windows 2003 Server R2 Enterprise Edition Service Pack 2, Dollar Universe 2.4. Thanks

James

Comments

  • cartmancartman EarthPosts: 31
    Hello,

    It looks like a Windows rights related issue.

    Can you test with another $U command in your web service - like "uxlst node" for example? Does it fail? With which message?

    Eric JT
  • stephane.pagestephane.page Guest Posts: 27
    HI

    for windows
    in your fic useralias.txt, insert the correspondance bewteen the user who execute call and the user $U
    probably not the same

    user $U TOTO
    user who make the call system
    in your useralias.txt
    #<LoginDomain Name> <Login User Name> <$U User>
    AUTORITE_NT system toto


    test it
  • menmen EuropePosts: 3,942 Specialist ✭✭✭✭
    On english based Windows, replace

    AUTORITE_NT SYSTEM '$U user'

    by

    NT_AUTHORITY SYSTEM '$U user'

    Michel
  • JamesMPJamesMP Guest Posts: 5
    cartman wrote on December 16 2008, 10:39 AM:
    Hello,

    It looks like a Windows rights related issue.

    Can you test with another $U command in your web service - like "uxlst node" for example? Does it fail? With which message?

    Eric JT


    Hi,
    Thanks for reply. I called uxordre.exe without any command line arguments resulting in the response: "Qualifier missing (UG)", so I am able to run the executable itself, but Dollar Universe is not allowing the running of a job specified in the MU. Also I called uxlst.exe and received the response,"Conpany environment not found ". It looks like Windows is permitting the execution of the executables.

    James
  • JamesMPJamesMP Guest Posts: 5
    men wrote on December 17 2008, 07:18 AM:
    On english based Windows, replace

    AUTORITE_NT SYSTEM '$U user'

    by

    NT_AUTHORITY SYSTEM '$U user'

    Michel


    Hi,
    Thanks for the reply. When the webservice calls uxordre.exe, the Task Manager shows that the user "Network Service" as the calling process. In the useralias.txt , I have the following:


    LEGASIS2 univa univa
    LEGASIS2 univd univd
    LEGASIS2 univo univo
    LEGASIS2 Production Production
    NT_AUTHORITY SYSTEM univa
    #LEGASIS2 NETWORKSERVICE univa DOES NOT WORK!!!
    #NT_AUTHORITY NETWORKSERVICE univa DOES NOT WORK!!!
    #LEGASIS2 NETWORK_SERVICE univa DOES NOT WORK!!!
    #NT_AUTHORITY NETWORK_SERVICE univa DOES NOT WORK!!!
    #NT_AUTHORITY 'NETWORK SERVICE' univa DOES NOT WORK!!!
    #NT_AUTHORITY NETWORK SERVICE univa DOES NOT WORK!!!
    #LEGASIS2 'NETWORK SERVICE' univa DOES NOT WORK!!!

    Since the user "Network Service" is the logged in user, I am not sure how to enter it correctly in the file.


    James
  • JamesMPJamesMP Guest Posts: 5
    gremlins wrote on December 17 2008, 06:22 AM:
    HI

    for windows
    in your fic useralias.txt, insert the correspondance bewteen the user who execute call and the user $U
    probably not the same

    user $U TOTO
    user who make the call system
    in your useralias.txt
    #<LoginDomain Name> <Login User Name> <$U User>
    AUTORITE_NT system toto


    test it



    Hi,
    Thanks for the reply. The webservice, which calls uxordre.exe, is identified as imagename:w3wp.exe and username: NETWORK SERVICE in Task Manager. Logged in users who's name does not have a space seem to work with "univa". In the useralias.txt , I have the following:


    LEGASIS2 univa univa
    LEGASIS2 univd univd
    LEGASIS2 univo univo
    LEGASIS2 Production Production
    NT_AUTHORITY SYSTEM univa
    #LEGASIS2 NETWORKSERVICE univa DOES NOT WORK!!!
    #NT_AUTHORITY NETWORKSERVICE univa DOES NOT WORK!!!
    #LEGASIS2 NETWORK_SERVICE univa DOES NOT WORK!!!
    #NT_AUTHORITY NETWORK_SERVICE univa DOES NOT WORK!!!
    #NT_AUTHORITY 'NETWORK SERVICE' univa DOES NOT WORK!!!
    #NT_AUTHORITY NETWORK SERVICE univa DOES NOT WORK!!!
    #LEGASIS2 'NETWORK SERVICE' univa DOES NOT WORK!!!
    LEGASIS2 jphillip univa

    Since the user "Network Service" is the logged in user, I am not sure how to enter it correctly in the file.


    James
  • JamesMPJamesMP Guest Posts: 5
    JamesMP wrote on December 13 2008, 02:38 PM:
    Hi,
    I have setup a C# web service to call uxordre.exe . My call is "d:\universe\conupr\exec\uxordre.exe UPR=JOB_ME501 MU=W_LEGASIS". When I execute the above-mentioned from the DOS command prompt , it works. However, when my web service tries the same call, it receives the message: "Access Denied - Insufficient Priviliges". I noticed that when the webservice is excuting other tasks , the Windows task manager indicates the user as NETWORK SERVICE .The web service can run other executables on the machine without any problems. I have set the security permissions on the Dollar Universe folder for the user "NETWORK SERVICE" to full control. Dollar Universe has been set up to use the user "production". I have tried to make the webservice use impersonation of the "production" account to no avail. Someone suggested that I must call uxsetenv.bat, then call uxordre.exe, but it had no effect. Is there a setting that I must set to allow the account "NETWORK SERVICE" to run uxordre. My platform is Windows 2003 Server R2 Enterprise Edition Service Pack 2, Dollar Universe 2.4. Thanks

    James


    Hi everyone,
    I have resolved the issue. Here's the fix I did to use a logged-in username, "Network Service" which contains spaces:

    First step was to ensure that the user "Network Service" has appropriate permissions(execute/write) on the Dollar Universe folders. As most of you are aware, on a Windows system, where the file system is NTFS, you right click on the file/folder, select properties, and then on the security tab.

    Second, I had to correctly add an entry for the "Network Service" logged-in user in the %$U%/conupr/mgr/useralias.txt file.
    For example,
    _TAB_ = tab character
    _SPC_ = space character

    <Domain>___________<Log in user>_____________<$U user>
    NT_AUTHORITY_TAB_Network_SPC_Service_TAB_Production

    Once again,thanks to all those who replied.



    James
  • menmen EuropePosts: 3,942 Specialist ✭✭✭✭
    Hi James,

    thank you for posting the good news!

    Michel
This discussion has been closed.