Deleting a npm package throws a UnauthorizedAccessException

We've been using ProGet for several months now and we ran into this exception trying to delete any npm package. Pushing new npm packages works just fine. Deleting nuget packages also works. Our ProGet server is hosted as a Windows Service.

See the exception details below.

Server Error in '/' Application.
Access to the path 'H:\ProGet\Packages\.npm\F2\our-package\2.2.3\package.tgz' is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 

Exception Details: System.UnauthorizedAccessException: Access to the path 'H:\ProGet\Packages\.npm\F2\our-package\2.2.3\package.tgz' is denied. 

ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user. 

To grant ASP.NET access to a file, right-click the file in File Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access.

Source Error: 

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace: 


[UnauthorizedAccessException: Access to the path 'H:\ProGet\Packages\.npm\F2\our-package\2.2.3\package.tgz' is denied.]
   System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) +417
   System.IO.File.InternalDelete(String path, Boolean checkHost) +14691099
   Inedo.IO.FileEx.Delete(String path) +93
   Inedo.ProGet.Extensions.FileSystems.DirectoryFileSystem.DeleteFileAsync(String fileName) +17
   Inedo.ProGet.Feeds.Npm.<DeletePackageAsync>d__15.MoveNext() +349
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Inedo.ProGet.WebApplication.Pages.Npm.Packages.<<CreateChildControls>b__15_0>d.MoveNext() +305
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Inedo.Web.PageFree.<ProcessPostAsync>d__62.MoveNext() +522
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Inedo.Web.PageFree.<ProcessPostAsync>d__62.MoveNext() +798
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   Inedo.Web.PageFree.<ProcessRequestAsync>d__46.MoveNext() +575
   System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +31
   System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) +60
   System.Web.TaskAsyncHelper.EndTask(IAsyncResult ar) +59
   Inedo.Web.Handlers.AsyncHandlerWrapper.EndProcessRequest(IAsyncResult result) +33
   System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +618
   System.Web.HttpApplication.ExecuteStepImpl(IExecutionStep step) +213
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +131

Product: ProGet
Version: 5.1.22

Is the ProGet service running as a user with admin privileges? Does that user have permission to delete files from H:\ProGet\Packages.npm? Is this IIS hosted?

This is not IIS hosted, it is running as a Windows Service. When I open up Task Manager, it is running as a Network Service. My understanding is that user should have the ability to delete those files. All of the ProGet folders, including both the NPM and Nuget folders, have the same file permissions. However, NPM packages are the only packages throwing this exception.

What about the permission on the tgz files themselves? The process that publishes them may grant insufficient privileges to delete. Can you manually delete the .tgz?

Here are the permissions of a .tgz compared to the permissions the .nupkg are receiving.

Image Text

Sorry, previous post was attached incorrectly.

Image Text

Nothing stands out there. Did you try what was suggested in the error output?

"ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity. ASP.NET has a base process identity (typically {MACHINE}\ASPNET on IIS 5 or Network Service on IIS 6 and IIS 7, and the configured application pool identity on IIS 7.5) that is used if the application is not impersonating. If the application is impersonating via <identity impersonate="true"/>, the identity will be the anonymous user (typically IUSR_MACHINENAME) or the authenticated request user.

To grant ASP.NET access to a file, right-click the file in File Explorer, choose "Properties" and select the Security tab. Click "Add" to add the appropriate user or group. Highlight the ASP.NET account, and check the boxes for the desired access."

The ProGet Windows service was installed as an Integrated Web Server since it is not IIS.

I ended up working around this by elevating ProGet Service and ProGet Web Server to run under the "Local System" account instead of "Network Service". This is effectively elevating ProGet to root. Not great that I had to do this because something is broken with the default installation permissions and settings.

You got it working though :)