DOCUMENT:Q191566  22-AUG-2001  [iis]
TITLE   :PRB: Cannot Access Network Resource If Client Certificate Mapped
PRODUCT :Internet Information Server
PROD/VER::4.0,5.0
OPER/SYS:
KEYWORDS:kbASP kbGrpDSASP kbDSupport kbiis400 kbiis500

======================================================================
-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Internet Information Server versions 4.0, 5.0 
-------------------------------------------------------------------------------

SYMPTOMS
========

Active Server Pages (ASP) access to network resources fails if the application
is running a Secure Sockets Layer (SSL) session that utilizes a client
certificate that is mapped to a Microsoft Windows NT account.

Examples of errors include the following:

 - If you use Scripting.FileSystemObject to access a file that is stored on a
   network share, you receive the following error message:

   Server object error 'ASP 0177:800a0046'
   Server.CreateObject Failed

 - If you access a Microsoft Access database on a network server, you receive
   the following error message:

   Microsoft OLE DB Provider for ODBC Drivers error '80004005'

   [Microsoft][ODBC Microsoft Access 97 Driver] The Microsoft Jet
   Database engine cannot open the file '******'. It is already opened
   exclusively by another user, or you need permission to view its data.

For additional information on accessing network resources from IIS, click the
article number below to view the article in the Microsoft Knowledge Base:

   Q158229 INFO: Security Ramifications for IIS Applications

CAUSE
=====

These errors occur because the Client Certificate Mapping process performs a
NETWORK logon when it impersonates the mapped userid. A NETWORK logon disallows
access to resources outside of those that exist on the local computer.

RESOLUTION
==========

To work around this issue, move data locally, or do not map your client
certificate to a Windows NT account. Other options include using Anonymous or
Basic authentication.

Additional query words:

======================================================================
Keywords          : kbASP kbGrpDSASP kbDSupport kbiis400 kbiis500 
Technology        : kbiisSearch kbiis500 kbiis400
Version           : :4.0,5.0
Issue type        : kbprb

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 2001.