Server Error Immediately After Upgrade to 4.1.4

[TCM]

I just upgraded Vault from 4.0.6 to 4.1.4 on my server. I now get an error when I try to use Vault. If I run the Admin Web Client on the server, I get a page with the message shown below. I've attached vault_install.log and sgvault.log.

-TCM

----
Server Error in '/VaultService' Application.
Configuration Error
Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: Could not load file or assembly 'MatsonWebUtilities' or one of its dependencies. The system cannot find the file specified. (C:\Inetpub\wwwroot\MatsonConsultingLive\web.config line 35)

Source Error:

Line 33: -->
Line 34: <httpModules>
Line 35: <add name="MatsonWebUtilities.HttpModule" type="MatsonWebUtilities.HttpModule, MatsonWebUtilities"/>
Line 36: </httpModules>
Line 37: </system.web>


Source File: C:\Inetpub\wwwroot\MatsonConsultingLive\web.config Line: 35

[Beth]

Could you post a screenshot of the error?

Can you reach http://localhost/vaultservice from on the Vault server machine?

[TCM]

Beth,

I've attached a screenshot of the error.

When I browse to http://localhost/vaultservice on the server, I'm prompted for a username and password. If I provide a valid Windows account, I get a page which says "Directory Listing Denied / This Virtual Directory does not allow contents to be listed."

-TCM

[Beth]

When I browse to http://localhost/vaultservice on the server, I'm prompted for a username and password.

That means something isn't right with your anonymous access. Go to your IIS manager, right-click vaultservice and select properties. Go to Directory Security and click the top Edit. Make sure anonymous access is checked. If it is and it makes you log in, then something isn't right with the user being used for the anonymous login. Usually, it's the IUSR account that is the user, but it can be run under some other account that has access.

On the screenshot you posted, the wrong web path came up, so localhost must just be pointing there. Try the same URL but with the machine name.
http://<your Vault server>/vaultservice

How many websites are you running on this machine?

[TCM]

Beth,

On my server, anonymous access is intentionally disabled for the default website (localhost). (Does v4.1.4 require anonymous access to the default website? I don't think v4.0.6 did.) As an experiment, I enabled anonymous access to localhost. When I browse to http://localhost/vaultservice on the server, I'm no longer prompted for a username and password, but I still get a page which says "Directory Listing Denied / This Virtual Directory does not allow contents to be listed."

When I navigate to http://DEDJ103/vaultservice, I get a page which says "The page cannot be found / The page you are looking for might have been removed, had its name changed, or is temporarily unavailable...".

There are six websites on the server, with many virtual directories.

-TCM

[Beth]

The anonymous user has been used with Vault for many years. You may have had some alternative configuration, but I don't know what that would be.

Are all the virtual directories for all the websites installed under one website, or do each have their own website?

Does NT Authority/Network Service have read/write access to the Vault virtual directories? By default, the location would be C:\Inetpub\wwwroot\vaultservice.

[TCM]

Beth,

I think the anonymous user thing is a red herring. I've never enabled anonymous access to the default site, but I've always had anonymous access enabled for the IUSR account on MatsonConsulting.com, which is the website where VaultService resides.

There are 29 virtual directories under 4 websites. Two of the virtual directories were created by Vault: VaultService and VaultShadowService

Network Service has "Full Control" (including "Read" and "Write") privileges on the C:\Inetpub\wwwroot\vaultservice. I spot-checked the effective permissions on several files in the subfolders, and Network Service seems to have full control everywhere.

-TCM

[Beth]

I've always had anonymous access enabled for the IUSR account on MatsonConsulting.com, which is the website where VaultService resides.

That's all you need.

Looking back at your screenshot...the line it mentions is not something that is normally in a Vault web.config file. Not a single one of mine have that section. Could you comment out that section and see how Vault reacts then?

[TCM]

Beth,

That line is in C:\Inetpub\wwwroot\MatsonConsultingLive\Web.config. For some reason, Vault is referencing that Web.config, even though it shouldn't be. When I comment out that line, I'm able to get into the admin site with http://63.134.216.104/vaultservice/admin and the Vault client seems to work. However, that line is required by the MatsonConsulting.com site, so I can't comment it out permanently.

-TCM

[Beth]

Are you using host headers?

Is the web.config that is being used above the vaultservice virtual directory? By that I mean is it in a parent directory?

Does that particular web.config force a user to authenticate before receiving web pages?

[TCM]

Beth,

I'm not using host headers. While looking for a solution to this problem, I experimented with host headers, and it doesn't seem to make a difference whether I use them or not.

The Web.config that is being used is in the parent website of the VaultService directory. It doesn't require users to authenticate.

-TCM

[Beth]

The web.config that is at the highest level in a website is the one that will be used and that's what it looks like is happening here. You could either change the layout and reinstall Vault, or you could try creating a new website that Vault could go under. If you don't want to use another IP address, you could give the Vault website just a different port.

[TCM]

Beth,

That was it. I reconfigured the structure of the websites on my server, and Vault now works properly. Thank you for the time you spent helping me diagnose the problem.

-TCM

[Beth]

Thanks for the update. Happy to hear you are working again.