Sitecore 8.1 update 2 on Azure environment gives "Access denied for debug folder of path /sitecore module/debug" when trying to login

Question

We are getting a weird issue on CM environment.(Sitecore 8.1 update 2)

Pages works fine when direct url is used, but error comes when we try login to sitecore

AppPool recycle solves the issue

Access to the path 'c:\inetpub\wwwroot\cm-prod.npower.com-2016.11.9.1-deployments-2086\sitecore modules\debug' is denied

Log shows above error and some of the times it also shows Access to the path 'C:\inetpub\wwwroot\cm-prod.npower.com-2016.11.9.1-Deployments-2086\sitemaps\' is denied. along with above error

I thought to be permission related issue but folder is not at all there and the issue gets resolved after app pool recycle. Issue comes once in a while (intermittent) but when issue start coming it stays there till app pool is recycled.

App pool identity is set to default app Pool idetity and all folder are set as modify access to IUSR_MachineName

snap of error given below

---

Ading stack trace as I captured it as image when error occured.

Full stack trace given below

Server Error in '/' Application.
________________________________________
Access to the path 'c:\inetpub\wwwroot\cm--2016.11.9\sitecore modules\debug' is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.UnauthorizedAccessException: Access to the path 'c:\inetpub\wwwroot\cm--2016.11.9\sitecore modules\debug' is denied. 

ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user. 

To grant ASP.NET access to a file, right-click the file in File Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.

Source Error: 
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace: 

[UnauthorizedAccessException: Access to the path 'c:\inetpub\wwwroot\cm--2016.11.9\sitecore modules\debug' is denied.]
   System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +636
   System.IO.Directory.InternalCreateDirectory(String fullPath, String path, Object dirSecurityObj, Boolean checkHost) +1349
   System.IO.Directory.InternalCreateDirectoryHelper(String path, Boolean checkHost) +73
   Sitecore.Web.UI.XmlControls.FolderControlSource.GetDebugFolder() +61
   Sitecore.Web.UI.XmlControls.FolderControlSource.AssemblyResolve(Object sender, ResolveEventArgs args) +79
   System.AppDomain.OnAssemblyResolveEvent(RuntimeAssembly assembly, String assemblyFullName) +195

[FileLoadException: Could not load file or assembly 'Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. Access is denied.]
   System.RuntimeTypeHandle.GetTypeByName(String name, Boolean throwOnError, Boolean ignoreCase, Boolean reflectionOnly, StackCrawlMarkHandle stackMark, IntPtr pPrivHostBinder, Boolean loadTypeFromPartialName, ObjectHandleOnStack type) +0
   System.RuntimeTypeHandle.GetTypeByName(String name, Boolean throwOnError, Boolean ignoreCase, Boolean reflectionOnly, StackCrawlMark& stackMark, IntPtr pPrivHostBinder, Boolean loadTypeFromPartialName) +106
   System.RuntimeType.GetType(String typeName, Boolean throwOnError, Boolean ignoreCase, Boolean reflectionOnly, StackCrawlMark& stackMark) +62
   System.Type.GetType(String typeName) +42
   System.Web.Helpers.Claims.ClaimsIdentityConverter.GetDefaultConverters() +123
   System.Web.Helpers.Claims.ClaimsIdentityConverter..cctor() +126

[TypeInitializationException: The type initializer for 'System.Web.Helpers.Claims.ClaimsIdentityConverter' threw an exception.]
   System.Web.Helpers.AntiForgery.CreateSingletonAntiForgeryWorker() +168
   System.Web.Helpers.AntiForgery..cctor() +15

[TypeInitializationException: The type initializer for 'System.Web.Helpers.AntiForgery' threw an exception.]
   System.Web.Helpers.AntiForgery.GetHtml() +63
   Sitecore.ExperienceEditor.Speak.Ribbon.PageExtender.RibbonWebControl.DoRender(HtmlTextWriter output) +832
   Sitecore.Web.UI.WebControl.RenderAsText() +227
   Sitecore.Mvc.ExperienceEditor.Pipelines.RenderPageExtenders.SpeakRibbon.RenderPageEditorSpeakExtender.Render(TextWriter writer) +116
  Sitecore.Mvc.ExperienceEditor.Pipelines.RenderPageExtenders.RenderPageExtendersProcessor.Process(RenderPageExtendersArgs args) +65
   (Object , Object[] ) +74
   Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args) +484
   Sitecore.Mvc.Pipelines.PipelineService.RunPipeline(String pipelineName, TArgs args) +184
   Sitecore.Mvc.ExperienceEditor.PageExtenderResponseFilter.GetExtendersHtml() +158
   Sitecore.Mvc.ExperienceEditor.PageExtenderResponseFilter.get_ExtendersHtml() +31
   Sitecore.Mvc.ExperienceEditor.Pipelines.Request.RequestEnd.AddPageExtenders.Process(RequestEndArgs args) +200
   (Object , Object[] ) +74
   Sitecore.Pipelines.CorePipeline.Run(PipelineArgs args) +484
   Sitecore.Mvc.Pipelines.PipelineService.RunPipeline(String pipelineName, TArgs args) +184
   Sitecore.Mvc.Routing.RouteHttpHandler.EndProcessRequest(IAsyncResult result) +135
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +399
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +137

________________________________________
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1069.1

Answer 1

If you are using the Sitecore Azure module for deploying Sitecore solution to Platform-as-a-Service (PaaS) environment (Azure Cloud Services), then the reason of the issue is due to incorrect script that sets permission in the file system:

• https://kb.sitecore.net/articles/077317

Answer 2

I believe that method instigates the following pipeline:

<speak.client.initialize.layout>
  <processor type="Sitecore.Web.Pipelines.InitializeSpeakLayout.CheckUserAccess, Sitecore.Speak.Client" />
  <processor type="Sitecore.Web.Pipelines.InitializeSpeakLayout.SetDisplayMode, Sitecore.Speak.Client" />
  <processor type="Sitecore.Web.Pipelines.InitializeSpeakLayout.SetAntiForgeryToken, Sitecore.Speak.Client" />
  <processor type="Sitecore.Web.Pipelines.InitializeSpeakLayout.DisableAnalytics, Sitecore.Speak.Client" />
</speak.client.initialize.layout>

You could check that this hasn't been customized (it's normally found in Sitecore.Speak.config).

Looking at the code in those pipelines - if it's not custom code it'll be trying to write the AntiForgeryToken in that folder (it must be the default folder set when you create a new StringWriter).

I'd log this as an issue with Sitecore and create those folders in the interim.

Answer 3

Adding correct user(IIS user) permission to website folder as per Sitecore document solved this issue.

Note:- This answer has been added to solve this issue. Still I am clue less on why an AppPool recycle was able to solve the issue.