Intermittent "HTTP 403 – Forbidden" error while trying to browse to a SharePoint web app

Consider a scenario where you receive the following error when you browse to a SharePoint web app

The website declined to show this webpage
HTTP 403
Most likely causes:
This website requires you to log in.

This issue is intermittent. Strangely, if we create a copy of the web.config file, rename the web.config file, refresh the home page, we receive an "HTTP 404 - Page Not Found" error. Rename the web.config file back and refresh the page. The site is browse able for a while before failing after some time

We see the following error in Failed Request Tracing

A procmon trace captured while accessing the web app from the server showed the following:

w3wp.exe 4180 CreateFile C:\inetpub\wwwroot\wss\VirtualDirectories\Web80.Contoso.com80\binACCESS DENIED Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, 

Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, Impersonating:NT AUTHORITY\IUSR

This issue usually occurs when a request from an authenticated user without local admin rights results in a failed read of the /BIN directory by the impersonating w3wp.exe (IIS worker process for ASP.NET) process. This behavior is typically associated with lack of permissions to the temporary folder /BIN where ASP.Net assemblies are Just In Time (JIT) compiled.

Resolution

The solution is to ensure that the Authenticated Users or <SERVER NAME>\Users group (which usually contains DOMAIN\Users group) has Read & Execute, List Folder Contents and Read permissions on the/BIN folder below C:\inetpub\wwwroot\wss\VirtualDirectories\{Sitename80}. 

Follow the steps listed below to grant the required permissions: 

• Open Windows Explorer and navigate to the /bin directory of your web application
• Right-click on the folder and click on Properties
• Go to Security tab and click on Edit
• Click on Add and add the local server group Authenticated Users or <SERVER NAME>\Users (this usually contains DOMAIN\Users group).
• Select the Read & Execute, List Folder Contents and Read permissions (if you are planning to add Everyone to the /bin folder, grant Read permissions only)
• Click OK to apply the new settings

Refresh the page and we should be able to browse to the site.

There are instances where this permission needs to be re-applied as part of every deployment and we may often find that the permissions have reset after touching the Authentication Providers settings in Central Admin.

More Information

If an administrator accesses the site/feature that caused the error, the subsequent requests from non-administrators would succeed. This behavior is typically associated with lack of permissions to the temporary folder where ASP.Net assemblies are Just In Time compiled.

The freb trace shows a 403.0 for ManagedPipelineHandler

It seems to go through quite a few ASPNet events - but happens during the ASPNetPageRender - it goes to the ASPNetPageRender Enter, then ASPNetHTTPHandler Leave.Only then does it get a 403.0 which is not an official RFC error. The first sub-status for 403 is 403.0.

Application pool in Classic or Integrated mode 

1. Application Pool in Classic Mode – In this case, we can configure a Wildcard mapping for ASPNET_ISAPI.dll at the website level. That would propagate to child virtual directories. That should not need any further modifications at the virtual directory level.
2. Application Pool in Integrated Mode – In this case, all relevant virtual directories would need individual modifications. They need to be set for specific handler. E.g. ‘book’ virtual directory needs mapping for BookAPI and ‘movie’ directory would need mapping for MovieAPI.

IIS Application Pool Availability Event ID

Event ID	Source	Message
1026	Microsoft-Windows-IIS-W3SVC	The World Wide Web Publishing Service (WWW Service) encountered an error when it tried to secure the handle of application pool %1 from HTTP.sys. Edit the identification information for the application pool so that the WWW Service can secure the handle of the application pool again. The data field contains the error number.
1027	Microsoft-Windows-IIS-W3SVC	Application pool %1 has been disabled. The HTTP.sys request to enable the application pool failed. The data contains the error number.
1084	Microsoft-Windows-IIS-W3SVC	Application pool %1 was not disabled. The HTTP.sys request to disable the application pool failed. The data contains the error number.
1089	Microsoft-Windows-IIS-W3SVC	The World Wide Web Publishing Service (WWW Service) did not issue a demand start to HTTP.sys for application pool %1. The data field contains the error number.
2297	Microsoft-Windows-IIS-W3SVC-WP	The worker process for application pool '%1' encountered an error '%2' trying to read global module configuration data from file '%3', line number '%4'. Worker process startup aborted.
2299	Microsoft-Windows-IIS-W3SVC-WP	An application has reported as being unhealthy. The worker process will now request a recycle. Reason given: %1. The data is the error.
5002	Microsoft-Windows-WAS	Application pool '%1' is being automatically disabled due to a series of failures in the process(es) serving that application pool.
5009	Microsoft-Windows-WAS	A process serving application pool '%1' terminated unexpectedly. The process id was '%2'. The process exit code was '0x%3'.
5010	Microsoft-Windows-WAS	A process serving application pool '%1' failed to respond to a ping. The process id was '%2'.
5011	Microsoft-Windows-WAS	A process serving application pool '%1' suffered a fatal communication error with the Windows Process Activation Service. The process id was '%2'. The data field contains the error number.
5012	Microsoft-Windows-WAS	A process serving application pool '%1' exceeded time limits during start up. The process id was '%2'.
5013	Microsoft-Windows-WAS	A process serving application pool '%1' exceeded time limits during shut down. The process id was '%2'.
5014	Microsoft-Windows-WAS	The Windows Process Activation Service encountered an internal error in its process management of worker process '%2' serving application pool '%1'. The data field contains the error number.
5015	Microsoft-Windows-WAS	A process serving application pool '%1' was orphaned but the specified orphan action %2 could not be executed. The data field contains the error number.
5021	Microsoft-Windows-WAS	The identity of application pool %1 is invalid. The user name or password that is specified for the identity may be incorrect, or the user may not have batch logon rights. If the identity is not corrected, the application pool will be disabled when the application pool receives its first request. If batch logon rights are causing the problem, the identity in the IIS configuration store must be changed after rights have been granted before Windows Process Activation Service (WAS) can retry the logon. If the identity remains invalid after the first request for the application pool is processed, the application pool will be disabled. The data field contains the error number.
5025	Microsoft-Windows-WAS	Application pool '%1' exceeded its job limit settings.
5039	Microsoft-Windows-WAS	A process serving application pool '%1' reported a failure. The process id was '%2'. The data field contains the error number.
5054	Microsoft-Windows-WAS	Windows Process Activation Service (WAS) did not run the automatic shutdown executable %2 for application pool %1. The data field contains the error number.
5057	Microsoft-Windows-WAS	Application pool %1 has been disabled. Windows Process Activation Service (WAS) did not create a worker process to serve the application pool because the application pool identity is invalid.
5059	Microsoft-Windows-WAS	Application pool %1 has been disabled. Windows Process Activation Service (WAS) encountered a failure when it started a worker process to serve the application pool.
5082	Microsoft-Windows-WAS	A worker process with pid '%2' that serves application pool '%1' has been determined to be unhealthy (see previous event log message), but because a debugger is attached to it, the Windows Process Activation Service will ignore the error.
5091	Microsoft-Windows-WAS	The Windows Process Activation Service (WAS) did not run the automatic shutdown executable for application pool %1. The data field contains the error number.
5101	Microsoft-Windows-WAS	The Windows Process Activation Service (WAS) did not create application pool %1. The data field contains the error number.
5104	Microsoft-Windows-WAS	The Windows Process Activation Service (WAS) did not delete application pool %1. The data field contains the error number.
5107	Microsoft-Windows-WAS	The Windows Process Activation Service (WAS) did not modify application pool %1. The data field contains the error number.
5127	Microsoft-Windows-WAS	A worker process '%2' serving application pool '%1' is no longer trusted by the Windows Process Activation Service, based on ill-formed data the worker process sent to the service. The data field contains the error number.
5144	Microsoft-Windows-WAS	Application pool %1 has been disabled. Windows Process Activation Service (WAS) was unable to enable application pool %1, because the request that WAS sent to protocol %2 failed. The data field contains the error number.
5145	Microsoft-Windows-WAS	Application pool %1 was not be disabled. The request from protocol %2 to disable the application pool failed. Restart the application pool so that Windows Process Activation Service (WAS) can determine the correct state of the protocol. The data field contains the error number.
5146	Microsoft-Windows-WAS	Application pool %1 has been disabled. The request from protocol %2 to create the application pool failed. Restart the application pool so that Windows Process Activation Service (WAS) can determine the correct state of the protocol. The data field contains the error number.
5160	Microsoft-Windows-WAS	Windows Process Activation Service failed to create the internal protocol app pool object for app pool '%1' and protocol '%2'. The virtual site of the application needing this app pool protocol combination will be disabled (see next message). The data field contains the error number.
5163	Microsoft-Windows-WAS	Windows Process Activation Service (WAS) was unable to determine the security identifier (SID) for the worker process identity in application pool %1. WAS will be unable to provide the correct identity to listener adapters, which may prevent the worker process or processes in the application pool from processing requests for this protocol. To resolve this issue, change the worker process identity to a new identity and then change it back to the previous identity. The data field contains the error number.
5164	Microsoft-Windows-WAS	Windows Process Activation Service (WAS) was unable to notify protocol %2 about an identity change for application pool %1. This may prevent the worker process or processes in the application pool from processing requests for this protocol. To resolve this issue, change the worker process identity to a new identity and then change it back to the previous identity. The data field contains the error number.
5184	Microsoft-Windows-WAS	The Windows Process Activation Service recovered from a previous error creating app pool '%1'. See previously logged event(s).
5190	Microsoft-Windows-WAS	The Windows Process Activation Service has encountered an error during the SID mapping for the application pool '%1'. The application pool will be disabled. This typically happens if there are more than one application pool name that maps to the same SID. To resolve this issue, please change the name of the app pool and recommit the configuration changes. The data field contains the error number.

IIS Application Pool

IIS Windows Process Activation Service (WAS)

Internet Information Services (IIS) 7.0

Events and Errors

‘HTTP 500 INTERNAL SERVER ERROR’ IN SHAREPOINT 2013 CLAIM BASED AUTHENTICATION

Background :
if your SharePoint 2013 Web application is Claim Based Authentication and you are getting this error while accessing any sites in this Web application
Error in Event Viewer : Task Category : Claims Authentication

Description :
An exception occurred when trying to establish endpoint for context: An error occurred loading a configuration file: Either a required impersonation level was not provided, or the provided impersonation level is invalid.

Root Cause:
The Application pool account was missing the ‘Impersonate a client after authentication’ user right.

Work Around :
Step 1. Go to Start – Administrative tools – Local Security Policy – Local Policies – User Right Assignments – Impersonate a client after authentication – Properties

Step 2. Add the Application Pool account for the site which is not working(Click on Add user or group)
Step 3. Reboot the server
Step 4. Check again the site, It will work.