Search code examples
asp.netiiswebformsfile-existsvirtual-directory

How to Access Files in ASP.NET Web Forms Application via Virtual Directory on Network Location?

Processing files in a virtual directory under IIS is successful when the client is on the server but fails when the client is on another PC on the network.

We have an ASP.NET Web Forms application (c#) that accesses TIF files via a virtual directory pointing at a network location. For example, virtual directory named corpfiles points at \\FileServer\share. The application is an intranet site using Windows Authentication, and the users have access to the file share.

The web site is passed a number of URLs for TIF files on a page, e.g., ./corpfiles/file1.tif, ./corpfiles/file2.tif, etc. For each URL that ends in .tif the page (this code is in the page.aspx.cs code behind file):

  1. Gets the physical file path: var filePath = Server.MapPath(docUrl);
  2. Ensures the file exists: if (File.Exists(filePath))
  3. Converts the TIF to an in-memory PDF and presents it on the web page.

This all works testing from Visual Studio 2022 (I added the virtual directory to my applicationhost.config file for IIS Express), and when testing from the server hosting the site. However, the File.Exists call fails when the site is connected to from another box on the network.

The filePath returned by Server.MapPath is valid; the user is able to access the original file directly using it.

If I don't try to access the file and just past the original URL to the user they are able to download the .tif file without trouble. This isn't very useful since viewing the file outside of the application is clunky, but it does demonstrate they have access to the original file share.

Is this a multi-hop authentication issue? We have tried supplying specific credentials on the virtual directory and using the client's credentials.

What am I missing?

Solution

  • The problem was the delegation of credentials was not properly configured. The Domain Admin had to:

    1. Create an SPN for the file server: CIFS/FILESERVER
    2. Ensure the service account could delegate using Kerberos only to the new SPN.
    3. Give the service account access to the FILESERVER.

    The real-time conversion of TIFs to PDFs now works with the result being the users can view the PDFs within the application.