No models visible with 'restrict usergroup directories' in Webserver

Question

question

Rhyan H asked Oct 14, '21 Connor A commented Oct 23, '21

No models visible with 'restrict usergroup directories' in Webserver

I have set up FlexSim Web Server with IIS and Windows Authentication, following the instructions in the web server documentation, but I cannot see or access any models in the model directory when attempting to limit access based on usergroups, even when logged in as a user that is a member of the appropriate group.

Note that I can access all models in the model directory without issue when 'Restrict UserGroup Directories' is disabled in the web server configuration file.

Here are the details of my setup:

Hyper-V Virtual Machine running in Windows 10 host
Guest OS: Windows Server 2019

FlexSim Web Server installation (running in the Guest OS):
FlexSim 21.2.2
FlexSim Web Server 21.0.0
IIS 10.0
ASP.NET 4.7
iisnode v0.2.26 x64
URL Rewrite Module 2.1

My Web Server configuration file: flexsim webserver configuration.txt

I am accessing the web server from a browser in the guest OS (i.e. via http://localhost), to exclude network configuration from the problem as far as possible.
I log into the web server as the local user 'Administrator' (the built-in administrator account), which I have added to a local group that I created named 'FSWebServerUsers'. Once logged in, no models are shown in the drop-down after clicking 'Select Model':

I have a single folder within the model directory specified in the web server configuration file, named as the usergroup, which contains my model:
<model directory path>\FSWebServerUsers \ExampleModel.fsm

Can anyone see why this isn't working?

Thanks in anticipation.

Software Version:

FlexSim 21.2.2

flexsim webserver

1634197779554.png (27.6 KiB)

flexsim-webserver-configuration.txt (970 B)

· 1

5 |100000

Attachments: Up to 12 attachments (including images) can be used with a maximum of 23.8 MiB each and 47.7 MiB total.

Connor A commented · Oct 23, 2021 at 01:31 AM

Hi @Rhyan H, was one of Jacob Gillespie's or Kenny Macleod's answers helpful? If so, please click the "Accept" button at the bottom of the one that best answers your question. Or if you still have questions, add a comment and we'll continue the conversation.

If we haven't heard back from you within 3 business days we'll auto-accept an answer, but you can always unaccept and comment back to reopen your question.

0 ·

Answer 1 · 2021-10-18T17:45:19Z

Jacob Gillespie answered Oct 18, '21 Jacob Gillespie commented Oct 19, '21

Did you enable Windows Authentication in IIS? The "Use Windows Authentication" option in the config file does nothing when using IIS.

Are the Server and the Guest OS on the same domain? Is the UserGroup a domain UserGroup?

Models are not being shown because it is unable to find which models you should have access to.

1634578574683.png (16.6 KiB)

· 2

5 |100000

Attachments: Up to 12 attachments (including images) can be used with a maximum of 23.8 MiB each and 47.7 MiB total.

Rhyan H commented · Oct 19, 2021 at 06:58 AM

Thanks for your reply Jacob.

Yes, Windows Authentication is enabled in IIS.

I neglected to state that the web server is running in the guest OS (I've updated my original question to make this clear), so am I right to assume that they must then be on the same domain? Apologies if I've misunderstood your question.

I should also mention that I have not enabled Active Directory on this VM, so the users and groups are all defined locally. Is Active Directory required for this feature to work?

(I have encountered the same issue on a second VM with the same configuration but with Active Directory enabled. I'm not particularly familiar with AD, so I've focused this question on the case where it's not enabled.)

0 ·

Jacob Gillespie ♦ Rhyan H commented · Oct 19, 2021 at 06:01 PM

I believe AD is required yes. And yes they must be on the same domain.

0 ·

Answer 2 · 2021-10-14T22:48:00Z

Kenny Macleod answered Oct 14, '21 Rhyan H commented Oct 19, '21

No solution from me but maybe a couple of pointers. Apologies for any obvious observations.

We've played with this in the past and getting windows authentication to work was a pain.

Other than the Active Directory stuff, which I have always kept clear of, there's nothing in WS config other than the two security flags..

I presume you are still in testing mode, which is why you're using the admin user. This can mask some authentication issues.

I suggest you add a new user and play with local authentication to allow and prevent access to your folder by adding/removing from the user group. By doing this before accessing via the webserver you will start eliminating where the issue lies.

· 1

5 |100000

Attachments: Up to 12 attachments (including images) can be used with a maximum of 23.8 MiB each and 47.7 MiB total.

Rhyan H commented · Oct 19, 2021 at 07:00 AM

Thanks for your suggestions Kenny.

I have tried creating another local user and adding them to the group, but this just results in identical behaviour to what I described above. (I should mention that in this case, and in my original post, I had not modified the Windows security settings for the model folder from their default settings.)

In an attempt to rule out folder permissions as the cause of the problem, I then tried explicitly adding my FSWebserverUsers group and both its users in the folder permissions settings, granting full control in all cases, but this made no apparent difference.

Hopefully my dialogue with Jacob above will reveal where I am going wrong.

0 ·

vmconnect-zegfjlgyov.png (43.3 KiB)

question