Access Denied on Web.config Azure Web Role

Question

My Azure web role suddenly stopped working with the following error.
"Access to the path 'F:\sitesroot\0\Web.config' is denied."
There was no recent published changes or configuration and it was working without any problems till yesterday! I checked the privileges for Web.config and I see all users have Read/Execute. Here is the stack trace:

    [UnauthorizedAccessException: Access to the path 'F:\sitesroot\0\Web.config' is denied.]
   System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +216
   System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) +1430
   System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy) +205
   System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share) +87
   System.IdentityModel.Tokens.UpdateValidatingIssuerNameRegistry.FlushDocument(String originalXml, String location) +218
   System.IdentityModel.Tokens.UpdateValidatingIssuerNameRegistry.UpdateIssuerNameRegistryElement(String pathToConfig, String fedMetadataAddress, String serviceName) +493
   Manager.MvcApplication.RefreshValidationSettings() in c:\GitHub\mfs_backoffice\2013_2.2\KCI.MFS.Manager\ManagerMFS\Global.asax.cs:37
   Manager.MvcApplication.Application_Start() in c:\GitHub\mfs_backoffice\2013_2.2\KCI.MFS.Manager\ManagerMFS\Global.asax.cs:30

[HttpException (0x80004005): Access to the path 'F:\sitesroot\0\Web.config' is denied.]
   System.Web.HttpApplicationFactory.EnsureAppStartCalledForIntegratedMode(HttpContext context, HttpApplication app) +12601629
   System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) +175
   System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) +304
   System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) +404
   System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) +475

[HttpException (0x80004005): Access to the path 'F:\sitesroot\0\Web.config' is denied.]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +12618676
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +159
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +12458293

Updade:
I also restarted, re-imaged and re-deployed the instance after I encountered the problem but neither worked. I also tried to copy my files to a different location on the instance (in D drive) and added it to IIS as another site, but still it gives me the same error when I try to browse it

Have you RDP'd to your web role instance to confirm the drive letter is still f: and hasn't changed to, say, e: ? — David Makogon, Jan 04 '16 at 19:44

score 0 · Accepted Answer · answered Jan 06 '16 at 20:30

Solution to our problem:

The problem was we were modifying Web.config in ApplicationStart() method for rolling our key based on Microsoft suggested approach for rolling new public keys : Important Information About Signing Key Rollover in Azure AD

    protected void RefreshValidationSettings()
    {
        string configPath = AppDomain.CurrentDomain.BaseDirectory + "\\" + "Web.config";
        string metadataAddress = ConfigurationManager.AppSettings["ida:FederationMetadataLocation"];
        ValidatingIssuerNameRegistry.WriteToConfig(metadataAddress, configPath);
    }

So I stopped using Microsoft approach for rolling public keys and it fixed the issue (now we need to update the public key manually once every six months). However I couldn't find why the permission policies have been changed on Azure Web Roles

Access Denied on Web.config Azure Web Role

1 Answers1

Solution to our problem: