“Access is denied” connecting to WAS-hosted WCF service using impersonation
July 10, 2008 – 4:49 pmThis error actually pertains to any IIS-hosted .Net Framework application that utilizes impersonation, but I ran into it implementing a WAS-hosted WCF service in Windows 2008. It rears its ugly head in the form of an exception message in the following format: “Could not load file or assembly *insert random assembly here* or one of its dependencies. Access is denied.” The assembly can be any of the many DLLs that you have in your bin\ directory for the application, and the error does not always appear, only intermittently. Restarting IIS, or changing files (forcing the app pool to cycle) will sometimes solve the problem temporarily, but never permanently.
The solution is to give all impersonated users write permissions to the ASP.Net temp directory (“%systemroot%\Microsoft .Net\Framework\v2.0.50727\Temporary ASP.NET Files” in the case of the 2.0/30/3.5 versions). MSDN talks briefly about the permissions needed for various Framework directories for impersonation and process users here: http://msdn.microsoft.com/en-us/library/aa719568.aspx I believe the problem is caused by the .Net Framework dynamically compiling portions of the app and/or referencing new DLLs for the first time as the impersonated user, and not being able to copy them to the temp directory. Obvious from the exception message, eh?