AddressAccessDeniedException: HTTP could not register URL https://+:8080/<…>.
A while back, when I was first doing WCF development I ran into the following exception:
AddressAccessDeniedException: HTTP could not register URL https://+:8080/<…>. Your process does not have access rights to this namespace.
The exception message included a link to an MSDN article that explained the concept of HTTP Namespace Reservations. Unfortunately the page suggests using an outdated, and not very user friendly tool called HttpCfg.exe to set up the namespace reservations. Even more unfortunate is the fact that this tool requires the user to enter a Security Descriptor Definition Language (SDDL) string by hand. Now, while I do enjoy the fact that I can now consider myself a member of the relatively small club of people that can read and write SDDL strings, this was not something I was especially excited about taking time away from the project at hand to do. Unfortunately search for help on the internet yielded more hurt than help.
What Not To Do
Upon performing my internet search, I ran straight into Mark Michaelis' post Windows Communication Foundation with Windows Vista and UAC. Now, generally speaking, I like Mark a lot, and he post a lot of good stuff on his blog. However, I am ethically opposed to what he is suggesting in his blog. Adding a manifest to your app to force elevation in Windows Vista is absolutely not what you should do! If you have a web serivce that has to run as Administrator then you are doing something wrong. In fact I hope you aren't even running as an Administrator account when you're developing (although aparently the Visual Studio team doesn't agree with me).
What To Do
Option 1: If you're on Windows Vista, you can use netsh. Nicholas Allen has details on his blog, as does Kenny Wolf.
Option 2: If you're not on Vista, or you want to set permissions as part of the setup process, take a look at the source code Keith Brown has posted on his blog.
Option 3: If you want a GUI based on C# code similar to that on Keith's blog, with a more flexible SDDL object model, then check out my tool, HttpNamespaceManager.
HttpNamespaceManager
This is not an official Microsoft tool, and should be considered sample code (see disclaimer below).
HttpNamespaceManager is available as either source code or an executable (both are in the attached zip file). It is licensed under the creative commons attribution license and is free to use, modify, and redistribute for commercial or non-commercial purposes. The project is divided into an API for managing HTTP Namespaces, including an object model for ACLs and Security Descriptors, and a UI with automatic elevation in Windows Vista for operations that require administrative privledge.
Requires .Net Framework 3.0 to run. Visual Studio 2005 & .Net Framework 3.0 to build.
This screen shot shows the start page of the Http Namespace Manager. All of the actions (Add/Edit/Remove) require elevation. Double clicking an item is the same as clicking the Edit button. The Remove button removes the entry permanently and without confirmation, so use caution.
When the Add button is clicked an input box is displayed in which the HTTP Namespace URL should be entered.
When the Edit button is clicked the following dialog is displayed. You must select a user or group in the top half of the form in order to set the permissions for it.
Disclaimer
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Comments
Anonymous
May 04, 2007
The comment has been removedAnonymous
May 04, 2007
I agree that having to get these ACLs set up is a royal pain. Which is precisely why I posted this. I want to make it easier so that developers can do the "right thing" and not run as administrator. There are a lot of organizations where the run as admin requirement would be a deal killer. Does your project use an MSI for deployment to staging and production servers? How do you configure the service account in your deployments? If there were a standalone VBS script, or a custom action for an MSI to set the ACLs would you use it? Personally I don't fully understand the rationale behind the HTTP reservation system, except that since http.sys does all multiple processes to bind to a single port with a different path, it makes some sense to allow applications to restrict who can use a particular URL. However I will forward your question on to some people and see if I can get you a more difinitive answer. Feel free to shoot me an email. sflanker (at) hotmail (dot) com.Anonymous
October 23, 2007
I'm on Windows Vista and i tryed to use you're tool but i get the same error. Any other methods to do that?Anonymous
October 23, 2007
The comment has been removedAnonymous
November 05, 2007
Thank you for posting this Paul! Your HttpNamespaceManager tool let me get around a problem that's been blocking me from running a WCF project that I've been working on. (Most of the project was developed on a machine running the dev environment as admin, but I ran into the access rights issue when I brought it into my more secured environment and was running visual studio as a regular user.) Just a note to anyone else making us of the tool... I received unhandled exceptions trying to run the tool as an unprivileged user, but it worked fine when I ran is as an administrator (which makes perfect sense..).Anonymous
December 09, 2007
Sergiu, I'm sorry you're having trouble getting the tool to work. I recommend you look at the source code to understand more of what's going on. Or you could send me a exception message/stack trace of the exception you're receiving and I can try and debug it. My email is sflanker (at) hotmail (dot) com. -PaulAnonymous
December 14, 2007
very interesting, but I don't agree with you IdetrorceAnonymous
December 16, 2007
Idetrorce, do you mind elaborating on what you don't agree with? -PaulAnonymous
March 03, 2008
One time I was playing with some of the Hands-on-Labs of Visual Studio 2008 Training kit then I'veAnonymous
March 17, 2008
Just wanted to say Hello to everyone. Much to read and learn here, I'm sure I will enjoy !Anonymous
March 26, 2008
Yesterday I presented to one of my financial services customers in the city on an overview of what'sAnonymous
April 04, 2008
Your tool saved my day. I was getting "HttpSetServiceConfiguration completed with 87" when using httpcfg. I don't have a clue what "87" means... I wasn't even sure if this was a problem or not. With your tool, I easily added the missing url. Thanks!Anonymous
June 10, 2008
Thanks so much for posting this - absolutely and without doubt saved me hours of work.Anonymous
July 03, 2008
This Tool ROCKS!!!!! Saved me from pulling out my few remaining hairs. Thanks!Anonymous
August 04, 2008
I ran your tool and got an exception in SecurityIdentityFromWellKnownSid with the call to LookupAccountSid returning a blank string. I'm running on Windows XP SP2. I tried running the .exe you included in the .ZIP file as well as building and running under VS 2008.Anonymous
August 07, 2008
����������! http://www.youtube.com/watch?v=WkjTeN6jGTkAnonymous
August 27, 2008
This tool works great on Windows Server 2008. Thanks for posting it.Anonymous
October 06, 2008
A project our team (in my employer) has been working on for a good number of months now makes extensiveAnonymous
October 06, 2008
A project our team (in my employer) has been working on for a good number of months now makes extensiveAnonymous
October 06, 2008
A project our team (in my employer) has been working on for a good number of months now makes extensiveAnonymous
October 06, 2008
A project our team (in my employer) has been working on for a good number of months now makes extensiveAnonymous
October 21, 2008
I was in an http Wcf endpoint hosted by a windows service scenario, stucked by the "HTTP could not register URL" error. Your post saved me. It works great on XP sp2 and Win 2003. Thank you.Anonymous
November 07, 2008
thanks bro'. great work. sorted me out straight away.Anonymous
November 12, 2008
This tool doesn't work under vista with the user logged in as a non-administratorAnonymous
November 19, 2008
The comment has been removedAnonymous
November 26, 2008
one thing I don't understand - my wizard created WCF project didn't need to use this tool, a service that I've created from scratch had this rights problem. what MS do with the wizard that bypass this thing ?Anonymous
December 29, 2008
While working with WCF services over HTTP you may come across this error: HTTP could not register URLAnonymous
January 05, 2009
The comment has been removedAnonymous
March 06, 2009
The comment has been removedAnonymous
March 31, 2009
Hello everybody, thanks for a useful tool. I still get the "Parameter is incorrect" exception when trying to register an URL with containing star convention (e.g. http:///+.80/Test/). If I try to register a complete URI (http://localhost:80/Test/), the HttpNamespaceManager succeeds. I'm running Windows XP SP3. Have you found a solution for this? T Thanks, TomasAnonymous
May 19, 2009
The comment has been removedAnonymous
May 19, 2009
@thomasek: Your url: http:///+.80/Test/ Has too many slashes after http and a period instead of a colon delimiting the host/port. Use HttpSysConfig instead; it's more guidedAnonymous
July 09, 2009
HttpSysConfig has a big advantage over the tool available on this page, it runs in Windows XP.Anonymous
September 08, 2009
Hi, Your tool is great ! But i want integrate it in a setup project so i want add a namespace using your lib. So, what are steps to add a new namespace without using WinForm ?Anonymous
September 08, 2009
Ok, i didn't read the option 2. DoneAnonymous
September 09, 2009
The comment has been removedAnonymous
October 20, 2009
I ran your tool and added a url but now it is throwing an exceptiong "Unable to Get Well Known SID" so the application doesn't do anything anymore. I debugged it and it loops through all the available urls but never returns the table dictonary to the caller.Anonymous
October 20, 2009
Now i cannot access my wcf services being hosted on IIS anymore. Help! I need this asap.Anonymous
January 23, 2010
Hey I downloaded your tool to cope up with the similar problem. The exe is throwing an exception "Unable to find SID" Could you please help.. Regards PrashantAnonymous
February 17, 2010
The comment has been removedAnonymous
February 25, 2010
Hi, that's a nice tool. Should I run it with elevated administrator permission? :P Regards, ibramAnonymous
February 26, 2010
Thank-you for the tool - it made a complicated confusing issue disappear.... You made my Friday afternoon that much more pleasant :)Anonymous
March 23, 2010
Yep, 3 years on and this blog is still a sanity-saver, TY!Anonymous
March 23, 2010
Ran this to sort "AddressAccessDeniedException" and it worked an absolute treat. This looked like it was going to take ages to sort so thanks so much for saving me hours! Cheers JonAnonymous
April 23, 2010
Just run VS as administrator and you will not have this issue. This works in VS 2010 on Windows 7.Anonymous
April 26, 2010
thank you thank you for the tool, i just wanna say you solved a problem when i was attempting to learn wcf, and implement the following simple example: http://channel9.msdn.com/shows/Endpoint/Endpoint-Screencasts-Self-hosting-WCF-Services/ Thank you again.Anonymous
May 14, 2010
The comment has been removedAnonymous
May 26, 2010
Thanks for sharing. It is very useful. Repeating same words from 'Bob W': "Thanks so much for posting this - absolutely and without doubt saved me hours of work."Anonymous
June 01, 2010
For those having the problem with the "Well Known SID", I was having the same problem and couldn't figure out why. I was using Windows 7 and used this utility a few months back and it worked, just opening it today to add another URL gave me the "Well Known SID" error and I couldn't manage my HTTP Namespaces. Doing a search on Google, you can use netsh to add and remove the HTTP Namespaces and avoid this buggy tool altogether. Example: netsh http add urlacl url=http://+:80/MyUri user=DOMAINuser Link: msdn.microsoft.com/.../ms733768.aspxAnonymous
June 17, 2010
I was wading through the netsh syntax and was about to try out this tool, but decided just to have my VS 2008 Run As Administrator (on Windows 7), this bypassed the error I received when my WCF service wanted to host itself in debug. Just FYI, this seemed an easier workaround for me for my purposes.Anonymous
July 07, 2010
Looking for all manner of jersey: http://www.jersey-nba.com.Anonymous
December 23, 2010
I create WCF service library and i test that working fine on WCF Test client(default). when i host the WCF service in winodws service that time i got the error. I am using windows XP sp3, .Net 3.5 and Visual Studio 2008. i got error. Error opening host : HTTP could not register URL "http://+:8731/WCFServerDLL/Service1/." Your process does not have access rights to this namespace (see "go.microsoft.com/fwlink for details). the above link for microsoft i implement the httpcfg. Here i run the "httpcfg.exe set urlacl /u http://localhost:8731/WCFServerDLL/Service1/ /a" i get the result HttpSetServiceConfiguration completed with 87. what is the problem i got same error. can you give me a suggation.Anonymous
February 27, 2011
I just want to thank you for this tool. it saved me a lot of time.Anonymous
March 15, 2011
The download link does not work anymore :(Anonymous
May 24, 2011
I am unable to use the HttpNameSpaceManager utility. Reports an error 'Unable to get SID'Anonymous
July 08, 2011
cheap customized nba jerseys, cheap authentic nba jerseys, cheap wholesale nba jerseys. http://www.shopnbajerseys.comAnonymous
July 24, 2011
The comment has been removedAnonymous
August 30, 2011
It is just what I’ve looking for and excited to read all the posts. I am looking forward to another great article from you. www.paylessnfljerseys.com Cheap NFL JerseysAnonymous
January 05, 2012
Keith Brown's blog entry linked in your post seems to have been deleted. The Wayback machine has a copy here: web.archive.org/.../15632.aspxAnonymous
October 25, 2012
Awesome tool. Thanks. I also had to run an iisreset in order to get this to work for me.Anonymous
January 30, 2013
Very nice, used it on windows 8 without any problems. easy peasy. tx alot!!Anonymous
July 15, 2013
It doesn't work for me (HttpNamespaceManager) on Windows 8, when I click on the Edit buttom, the application begins a strange behavior, openning and closing the forms quickly.Anonymous
September 16, 2013
Hi, we've ported your tool (particularly the HttpNamespaceManagerLib) to VS 2010 and used in one of our project. The program checks via HttpApi if it can be contacted on a particular port: if not it does elevation and adds it. the call is made in the Main() method with the following lines: HttpApi nsManager = new HttpApi(); Dictionary<string, SecurityDescriptor> nsTable; nsTable = nsManager.QueryHttpNamespaceAcls(); now: if I run the program from inside VS (both Debug/Release configurations) it works perfectly if I run the Debug exe from outside the VS IDE... it works it I run the Release exe from outside the VS IDE... it crashes the problem is in the return values of HttpQueryServiceConfiguration; when it works it returns a certain number of ERROR_INSUFFICIENT_BUFFER and a final ERROR_NO_MORE_ITEMS, when it crashes it returns a number of ERROR_NO_MORE_ITEMS (like a couple less than before) and a final code 6 (ERROR_INVALID_HANDLE?) Any idea anyone? thank you RobertoAnonymous
February 12, 2014
The comment has been removedAnonymous
February 12, 2014
The comment has been removedAnonymous
June 19, 2014
Thank you very much for this brilliant easy tool you have madeAnonymous
February 13, 2015
Leonardo Fraietta, same here--failed for me and opened and closed quickly over and over (when i tried to add) and I had to restart the PC.