IISNODE on newly created site in IIS8 on W8 x64 error

[StephenPAdams]

Hey guys,

Created a new website in IIS located here:
C:\dev\officerdio\source

With its own application pool. Set NETWORK SERVICE, IIS_IUSRS, and IUSR as having the appropriate permissions on that directory. Created an entry in my hosts file and the appropriate binding.

When accessing the site, I get a 500 error:

Module iisnode
Notification ExecuteRequestHandler
Handler iisnode
Error Code 0x00000002
Requested URL http://dev.officerdio.com:80/server.js
Physical Path c:\dev\officerdio\source\server.js
Logon Method Anonymous
Logon User Anonymous

Looking in the log file:

fs.js:520
return binding.lstat(pathModule._makeLong(path));
^
Error: EPERM, operation not permitted 'c:\dev'
at Object.fs.lstatSync (fs.js:520:18)
at Object.realpathSync (fs.js:1047:21)
at tryFile (module.js:142:15)
at Function.Module._findPath (module.js:181:18)
at Function.Module._resolveFilename (module.js:336:25)
at Function.Module._load (module.js:280:25)
at Module.runMain (module.js:492:10)
at process.startup.processNextTick.process._tickCallback (node.js:244:9)

However, running the built in examples that host itself at localhost/node works fine. Any ideas?

[tjanczuk]

If you are using node 0.8.x, you must make sure that the identity under which the node.exe process executes (which is the same as the identity of the IIS application pool) has FILE_READ_ATTRIBUTES permission on all ancestor directories of the directory where server.js is located, up to and including the root directory. This is required because node.js 0.8.x traverses the directory structure to normalize the file location by resolving directory junctions and links.

[hadynz]

In case it is of help, I had to assign READ permissions for IIS_IUSRS to both my node application and its parent folder. For example, I had to modify permissions as I just stated for an app hosted in C:\Dev\myapp to both folders C:\Dev and C:\Dev\myapp.

[rkneece]

Holy cow. After dealing with this all day, this totally saved me. I never would've thought about the permissions all the way up the tree. I had just been dealing with the permissions on the actual folder where the .js files are.

[simonlampen]

Had this recently when setting up a new dev machine and using a network share to transfer some files. Setting up this network share trashed the default permissions for accounts like "Authenticated Users" being able to read attributes during the lstat calls made by node.
I found this by comparing the default permissions on a newly created folder eg "c:\test-perm" with the folder hierarchy having issues eg "c:\web", in this case the web folder was missing some of these generic defaults.

Diagnose:
At the command prompt use "icacls " to check the permissions from the root of the drive down to your iis folder eg "icacls c:\web".
As well as Administrators and System, you should probably see entries for "Authenticated Users".

Fix:
Then to repair those missing permissions you can use "icacls /reset " to copy down inherited permissins from the root drive down to through the hierarchy to your iis folder to fix it, eg "icacls /reset c:\web".

So your IIS APPPOOL user does not need explicit permissions all the way to the root folder, it will use the implicit permissions from the other user roles.

Hope that helps someone else understand and fix the issue.