I have a webapp over tomcat6, which is installed as a service in a WinServer (2008 or 2003r2, don't know for sure, people haven't let me put a hand over it so far). The Tomcat service runs with a particular service account (not local, but created in the domain controller), different from the account running the server.
We have a domain controller, so our users are always checked against ActiveDirectory.
The webapp reads files from a folder in a network shared folder, which has lots of subfolders with particular restrictions. The subfolder designated to receive the files is configured to allow the service account with the following grants
- Go thru folder / execute file
- Read items
- Read attributes
- Read ext. attributes
- Create files / write data
- Create folders / annex data
- Write attributes
- Write ext. attributes
- Read permissions
And yet, my webapp is not able to reach the subfolder (which is just below the root folder of the network share,
//fileServer/sharedRootFolder/myFolder). The funny thing is: if I point the webapp to a subfolder that we use as a common point for sharing files among all employees (e.g.
//fileServer/sharedRootFolder/ourCommonFolder), the webapp CAN read the files.
The very same webapp running from a standalone Tomcat (same 6.x version) in my workstation can read both places (runs with my own domain account, which happens to have less permissions over the "unreachable" folder).
Are there extra configuration settings for the user, the windows service in the server or the permissions in the folder that I should be aware of??
P.S. I'm looking at the given permissions with right click-- properties-- security data.
EDIT: In this thread, the "logon as a service" is explained but, if the domain-based service account has right to access my desired subfolder on the network share (which is located in a different server, same local network) and the service account logs on as a service when starting the service, what else should I do in order to effectively have access to the network share subfolder???
//fileServer/sharedRootFolder/ourCommonFolder folder has permissions for Everyone, so I guess it points to something with the service config, the domain-based service account starting it and the "logon as a service" stuff or something like that.
EDIT3: Today, we configured 'logon as a service' for the service account (which was already a local administrator in the server) and it does not work yet. Running out of ideas...