Looks like I've got to the bottom the network access!

If I create the mapped drive (net use...) using proc_open rather than sysem() or exec() it can access it and Prince works!

I still have to create the mapped drive using exec() in order to write files to the drive as it doesn't work when created with proc_open

Doesn't explain the issue of not being able to resolve hostnames though on the https

Edited 9 Oct 2021 by oamobile

Excellent news.



Ok, this definitely does show that it's a permissions problem. Are you able to give access permissions to the mapped drive to the IIS apppool user? This would seem to solve your original issue.



Sorry, I'm unfamiliar with Windows permissions, but to take a guess, maybe the IIS apppool user is somehow being firewalled and can only access plaintext http? Are you able to check if there are any permissions on the IIS apppool user to block HTTPS please?

(Another way to verify this would be to somehow login as the IIS apppool user and see if you can go to a HTTPS website using the browser).

After some playing around with the different command functions, I think I have got to the bottom of the network access:

When the mapped drive is created, the credentials are provided in the cmd string so this meant it shouldn't be permissions related.

Here is an example cmd...

"net use E: \\webserver\images /user:InternalUsr psswrd123 /persistent:no>nul 2>&1"

When you run just "net use" on its own it should list all mapped drives.

If I create the drive manually from the command prompt, and run "net use" in PHP, neither exec() nor proc_open() can see the drive.

If I create it using PHP and exec(), then proc_open () can't see the drive and vice versa if created in proc_open.

Running "net use" from the command prompt manually, any drives created from PHP regardless of the method are not displayed.

It then dawned on me the drives are being created by different user accounts depening on which method the command is triggered by and so they must only be visible to the user account that created them!

-------------------------------------------------------------------------------------------------------

So I've concluded the following:

For the creating/modifying/reading of files within the rest of my application, I need to create the drive using exec() or system() as most file functions in PHP it seems use the IIS IUSR user account.

For the reading of the image files for use by Prince to create a PDF then I need to create the mapped drive using proc_open() as this is what the Prince wrapper uses, which uses the IIS AppPool user account.

So, massive thank you for your efforts in resolving this for me, I'm very grateful.

I do want to try and fix the https issue now as there is a good chance that in the near future I will need this functionality soon. I'll try and dig around permissions to see if I can find anything that might be blocking https

Edited 11 Oct 2021 by oamobile

For anyone else reading this, another solution thats just dawned me also is you can change the user account for the website in IIS to switch from IUSR to AppPool by going to Authentication and changing the Annonymous Authentication.

This then avoids having to set up two mapped drives, however requires all folder permissions in the website updating if any are set specifically for IUSR

Edited 11 Oct 2021 by oamobile

Excellent. Glad to have helped you get to the bottom of this!



So we've confirmed it's not DNS, and curl can't even access httpS resources but can with http, so it does sound like something is blocking the IIS apppool user. Maybe try using exec() to see if curl works with httpS... that way, you definitely know that there is some restriction somewhere on IIS apppool's permissions.