AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

MichaelGiagnocavo — Sat, 05 May 2007 03:26:31 GMT

Why does MS have this model for http.sys in the first place? You can bind a socket to an open port as a non-admin, you just can't use the Windows http code to do.

I can understand if your code is trying to use a port used by another application, and "hide" somewhere, i.e. http://server:80/secret/. But if you are doing a "full" bind to a port (i.e., "http://server:80/"), then it should treat it as the same as if you just bound a socket to that port (and not allow any other apps to access that port either). What am I missing here? The only thing I can think of is that some firewalls might not be able to figure out that Malware.exe is listening to port 8080 and not http.sys.

It is such a pain to have to deal with these ACLs. For WCF, we usually just don't use HTTP bindings (since netTcp doesn't have this issue). If we have to expose via HTTP outside of IIS, then yea, we make that app run as local admin. Sucks, but it's more manageable than having to make sure every machine (development, testing, staging, production) has these ACLs.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

paulwh — Sat, 05 May 2007 04:15:02 GMT

I agree that having to get these ACLs set up is a royal pain. Which is precisely why I posted this. I want to make it easier so that developers can do the "right thing" and not run as administrator. There are a lot of organizations where the run as admin requirement would be a deal killer. Does your project use an MSI for deployment to staging and production servers? How do you configure the service account in your deployments? If there were a standalone VBS script, or a custom action for an MSI to set the ACLs would you use it?

Personally I don't fully understand the rationale behind the HTTP reservation system, except that since http.sys does all multiple processes to bind to a single port with a different path, it makes some sense to allow applications to restrict who can use a particular URL. However I will forward your question on to some people and see if I can get you a more difinitive answer.

Feel free to shoot me an email. sflanker (at) hotmail (dot) com.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Sergiu — Wed, 24 Oct 2007 12:04:14 GMT

I'm on Windows Vista and i tryed to use you're tool but i get the same error. Any other methods to do that?

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Sergiu — Wed, 24 Oct 2007 12:06:20 GMT

Nad now i get a SDDL string format exception

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Peter Bernier — Mon, 05 Nov 2007 21:00:00 GMT

Thank you for posting this Paul!

Your HttpNamespaceManager tool let me get around a problem that's been blocking me from running a WCF project that I've been working on.

(Most of the project was developed on a machine running the dev environment as admin, but I ran into the access rights issue when I brought it into my more secured environment and was running visual studio as a regular user.)

Just a note to anyone else making us of the tool... I received unhandled exceptions trying to run the tool as an unprivileged user, but it worked fine when I ran is as an administrator (which makes perfect sense..).

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

paulwh — Mon, 10 Dec 2007 05:30:26 GMT

Sergiu, I'm sorry you're having trouble getting the tool to work. I recommend you look at the source code to understand more of what's going on. Or you could send me a exception message/stack trace of the exception you're receiving and I can try and debug it. My email is sflanker (at) hotmail (dot) com.

-Paul

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Idetrorce — Sat, 15 Dec 2007 14:58:56 GMT

very interesting, but I don't agree with you

Idetrorce

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

paulwh — Sun, 16 Dec 2007 22:51:12 GMT

Idetrorce, do you mind elaborating on what you don't agree with?

-Paul

AddressAccessDeniedException: HTTP could not register URL http://+:80/<…>.

The Trainer — Mon, 03 Mar 2008 19:07:37 GMT

One time I was playing with some of the Hands-on-Labs of Visual Studio 2008 Training kit then I've

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Sensbachtal — Tue, 18 Mar 2008 02:31:29 GMT

Just wanted to say Hello to everyone.

Much to read and learn here, I'm sure I will enjoy !

.net 3.5 - my recent presentation resources

Team Individualism — Thu, 27 Mar 2008 02:56:06 GMT

Yesterday I presented to one of my financial services customers in the city on an overview of what's

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Rui Covelo — Fri, 04 Apr 2008 19:08:59 GMT

Your tool saved my day. I was getting "HttpSetServiceConfiguration completed with 87" when using httpcfg. I don't have a clue what "87" means... I wasn't even sure if this was a problem or not. With your tool, I easily added the missing url. Thanks!

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Bob W — Tue, 10 Jun 2008 21:25:41 GMT

Thanks so much for posting this - absolutely and without doubt saved me hours of work.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Chris D — Fri, 04 Jul 2008 02:32:39 GMT

This Tool ROCKS!!!!! Saved me from pulling out my few remaining hairs. Thanks!

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Chad Knudson — Mon, 04 Aug 2008 17:39:54 GMT

I ran your tool and got an exception in SecurityIdentityFromWellKnownSid with the call to LookupAccountSid returning a blank string. I'm running on Windows XP SP2.

I tried running the .exe you included in the .ZIP file as well as building and running under VS 2008.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

devidblein — Fri, 08 Aug 2008 09:57:16 GMT

��!

http://www.youtube.com/watch?v=WkjTeN6jGTk

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

VistaSucks - Go Windows Server 2008 — Thu, 28 Aug 2008 05:52:20 GMT

This tool works great on Windows Server 2008. Thanks for posting it.

Some WCF Gotchas

cruizer — Tue, 07 Oct 2008 07:17:44 GMT

A project our team (in my employer) has been working on for a good number of months now makes extensive

Some WCF Gotchas

cruizer — Tue, 07 Oct 2008 07:22:50 GMT

A project our team (in my employer) has been working on for a good number of months now makes extensive

Some WCF Gotchas

cruizer — Tue, 07 Oct 2008 07:27:51 GMT

A project our team (in my employer) has been working on for a good number of months now makes extensive

Some WCF Gotchas

cruizer — Tue, 07 Oct 2008 08:12:06 GMT

A project our team (in my employer) has been working on for a good number of months now makes extensive

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Pierre — Wed, 22 Oct 2008 10:12:38 GMT

I was in an http Wcf endpoint hosted by a windows service scenario, stucked by the "HTTP could not register URL" error. Your post saved me.

It works great on XP sp2 and Win 2003.

Thank you.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

jester — Fri, 07 Nov 2008 16:41:44 GMT

thanks bro'. great work. sorted me out straight away.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Anonymous — Thu, 13 Nov 2008 00:55:00 GMT

This tool doesn't work under vista with the user logged in as a non-administrator

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Fatih Boy — Thu, 20 Nov 2008 00:29:33 GMT

Thanks for your tool. When i try to run your application i got "Invalid ACE String Format" exception.

So i just take a look at its source code. I would like to suggest following changes to make it culture invariant.

File : AccessControlEntry.cs

Line : 160

From : Regex aceRegex = new Regex(aceExpr, RegexOptions.IgnoreCase);

To : Regex aceRegex = new Regex(aceExpr, RegexOptions.IgnoreCase|RegexOptions.CultureInvariant);

File : Program.cs

Line : 25

From : Regex actionRegex = new Regex(@"(-|--|/)(?'action'ad?d?|ed?i?t?|re?m?o?v?e?)", RegexOptions.IgnoreCase);

File : AccessControlList.cs

Line : 78

From : Regex aclRegex = new Regex(AccessControlList.aclExpr, RegexOptions.IgnoreCase);

To : Regex aclRegex = new Regex(AccessControlList.aclExpr, RegexOptions.IgnoreCase|RegexOptions.CultureInvariant);

File : SecurityDescription

Line : 116

From : Regex sddlRegex = new Regex(SecurityDescriptor.sddlExpr, RegexOptions.IgnoreCase);

To : Regex sddlRegex = new Regex(SecurityDescriptor.sddlExpr, RegexOptions.IgnoreCase|RegexOptions.CultureInvariant);

Feel free to contact. fatih (at) enterprisecoding (dot) com.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Dani — Thu, 27 Nov 2008 15:08:16 GMT

one thing I don't understand - my wizard created WCF project didn't need to use this tool, a service that I've created from scratch had this rights problem.

what MS do with the wizard that bypass this thing ?

WCF Error: HTTP could not register URL http://+:8000/... Your process does not have access rights to this namespace

Anirban Chakladar|Blog — Mon, 29 Dec 2008 20:48:46 GMT

While working with WCF services over HTTP you may come across this error: HTTP could not register URL

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Todd — Mon, 05 Jan 2009 17:48:35 GMT

Awesome utility. Saved a lot o hairs from being pulled from my head.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Bus tickets — Sat, 07 Mar 2009 06:24:25 GMT

Why are they making so complicated for following just one sample code from someone. Almost all samples from MSDN talk about http://loca:8000 and then everyone is hit by the same error and there is no easy way to fix it.

I tried to run your code on Windows XP3 and it is giving me Parameter is incorrect exception. It is letting me add the user, checks the box but once i click OK button it gives an exception.

Thanks,

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Thomasek — Tue, 31 Mar 2009 16:23:22 GMT

Hello everybody,

thanks for a useful tool. I still get the "Parameter is incorrect" exception when trying to register an URL with containing star convention (e.g. http:///+.80/Test/). If I try to register a complete URI (http://localhost:80/Test/), the HttpNamespaceManager succeeds.

I'm running Windows XP SP3. Have you found a solution for this?

Thanks,

Tomas

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

matt — Tue, 19 May 2009 20:42:54 GMT

HttpSysConfig seems to be a better tool: smaller KBytes, fewer bugs and a better UI

If you use HttpNamespaceManager, don't delete all the entries! It screws the app up and you can't add any/it crashes upon startup

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

matt — Tue, 19 May 2009 20:44:19 GMT

@thomasek:

Your url:

http:///+.80/Test/

Has too many slashes after http and a period instead of a colon delimiting the host/port. Use HttpSysConfig instead; it's more guided

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Joel — Thu, 09 Jul 2009 23:08:44 GMT

HttpSysConfig has a big advantage over the tool available on this page, it runs in Windows XP.

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

r701653 — Wed, 09 Sep 2009 11:10:48 GMT

Hi,

Your tool is great !

But i want integrate it in a setup project so i want add a namespace using your lib.

So,

what are steps to add a new namespace without using WinForm ?

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

rg701653 — Wed, 09 Sep 2009 11:14:35 GMT

Ok, i didn't read the option 2.

Done

re: AddressAccessDeniedException: HTTP could not register URL http://+:8080/<…>.

Paulo Brito — Thu, 10 Sep 2009 14:36:01 GMT

I'm running a Windows XP SP3, in a machine that's, on the inside of, a company network domain, and as a consequence it's under the company's network

policies. I've tried to host a "WCF Service" using a "Windows Service" running with the permissions of "NT AUTHORITY\NetworkService" in this machine.

I also tried to run the service in solo, it runs ok. But when I add the code for the:

[C# code line 48] - host = new ServiceHost(typeof(PWCFService.PwService)); // this code line runs fine

[C# code line 49] - host.Open(); // this code line throws the ERROR!!!

The error is: "HTTP could not register URL http://+:8731/Design_Time_Addresses/PwService/. Your process does not have access rights to this namespace

(see http://go.microsoft.com/fwlink/?LinkId=70353 for details)."

This error does not go away. I already used the 'httpcfg' tool (trying all possible combinations of URL's and permissions) after that I used the

'HttpNamespaceManager' app and still, no can do. In both cases I visualised the results of the tools using the command 'httpcfg query urlacl', and I

realised that I was already able to obtain manually (with the 'httpcfg' tool) the same results as the 'HttpNamespaceManager' tool was getting.

One example of the results are: -----------------------------------------------------------

URL : http://+:8731/Design_Time_Addresses/

ACL : D:(A;;GAGXGWGR;;;S-1-5-21-1246633644-337528824-2052957216-3235)(A;;GAGXGWGR;;;NS)

-------------------------------------------------------------------------------------------

And I'm still stuck with this error...

{START - [[STACK TRACE]] }

at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen()

at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener)

at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback)

at System.ServiceModel.Channels.TransportChannelListener.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.HttpChannelListener.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Channels.DatagramChannelDemuxer`2.OnOuterListenerOpen(ChannelDemuxerFilter filter, IChannelListener listener, TimeSpan

timeout)

at System.ServiceModel.Channels.SingletonChannelListener`3.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.NegotiationTokenAuthenticator`1.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.CommunicationObjectSecurityTokenAuthenticator.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecurityUtils.OpenTokenAuthenticatorIfRequired(SecurityTokenAuthenticator tokenAuthenticator, TimeSpan timeout)

at System.ServiceModel.Security.SecurityProtocolFactory.Open(String propertyName, Boolean requiredForForwardDirection, SecurityTokenAuthenticator

authenticator, TimeSpan timeout)

at System.ServiceModel.Security.SymmetricSecurityProtocolFactory.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecurityProtocolFactory.Open(Boolean actAsInitiator, TimeSpan timeout)

at System.ServiceModel.Security.SecurityListenerSettingsLifetimeManager.Open(TimeSpan timeout)

at System.ServiceModel.Channels.SecurityChannelListener`1.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionSecurityTokenAuthenticator.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.CommunicationObjectSecurityTokenAuthenticator.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecurityUtils.OpenTokenAuthenticatorIfRequired(SecurityTokenAuthenticator tokenAuthenticator, TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionServerSettings.OnOpen(TimeSpan timeout)