icegridnode as windows service

[bernard]

Hi Edward,

Could you try with a different directory? (by editing icegridregistry.cfg) E.g. just C:\IceGrid\registry.

This "C:\Documents and Settings\LocalService" is just the default location for the LocalService home directory. It doesn't matter for Ice.

Thanks,
Bernard

[Edward Bishop]

Hi Bernard,
Same result:

C:\>iceserviceinstall.exe --Debug=3 icegridregistry C:\Ice-3.3.0-VC90\config\icegridregistry2.cfg
[ 10/21/08 12:13:45.236 iceserviceinstall.exe: IceServiceInstaller: SID: S-1-5-19; Full name: NT Authority\LocalService ]
Error: Could not retrieve effective rights for NT Authority\LocalService on C:\icegrid: Circular service dependency was specified.
Press any key to continue . . .

C:\sunflower\AutoTest\bin>

Here is the modified cfg file. I also changed the instance name so as not to conflict with the previously installed service (after I accumulate a few I'll delete them and reboot):

#
# Sample configuration file for the IceGrid registry daemon
#

#
# The IceGrid instance name; must be unique, to distinguish several
# IceGrid deployments
#
IceGrid.InstanceName=SampleIceGrid2

#
# Client object adapter: listens on all interfaces
# (add -h <name | IP address> to listen on just one interface)
# IANA-registered TCP ports for the IceGrid registry:
# - 4061 (insecure)
# - 4062 (secure, using SSL)
#
IceGrid.Registry.Client.Endpoints=tcp -p 4061
#IceGrid.Registry.Client.Endpoints=ssl -p 4062
#IceGrid.Registry.Client.Endpoints=tcp -p 4061:ssl -p 4062

#
# Server and Internal object adapters: listens on all interfaces
# using an OS-assigned port number.
#
IceGrid.Registry.Server.Endpoints=tcp
IceGrid.Registry.Internal.Endpoints=tcp

#
# The registry DB home; must exist when icegridregistry starts
#
# Under Vista we recommend using:
#
# C:\Windows\ServiceProfiles\LocalService\AppData\Local\ZeroC\icegrid\registry
#
IceGrid.Registry.Data=C:\icegrid\registry

#
# Authentication/authorization
# With NullPermissionsVerifier, any password is accepted (not recommended
# for production)
#
IceGrid.Registry.PermissionsVerifier=SampleIceGrid2/NullPermissionsVerifier
IceGrid.Registry.AdminPermissionsVerifier=SampleIceGrid2/NullPermissionsVerifier

#
# Default templates
#
IceGrid.Registry.DefaultTemplates=C:\Ice-3.3.0-VC90\config\templates.xml

#
# Trace properties.
#
IceGrid.Registry.Trace.Node=1
IceGrid.Registry.Trace.Replica=1

Thanks,

[bernard]

Hi Edward,

I don't know how this error can occur, and I can't reproduce it, so I've just posted a question on a Microsoft newsgroup.

Best regards,
Bernard

[Edward Bishop]

Hi Bernard,

Success (of a sort)!

Searching the web, it looks like GetEffectiveRightsFromAcl() has some strange bugs on a variety of platforms, although I could not find any record of this bug on this platform. So, I built iceserviceinstall with IceServiceInstaller::grantPermissions() modified to return immediately, and it worked! That is, I was able to install and run my collocated service.

I had to modify the LogOn / Account with the Windows Admin/Services dialog. The iceserviceinstall had set the account to NT Authority\Local Service. With that setting, I was unable to start my servers via IceGridGUI. I would get the error: "Error: can't reach this server's Admin object". After I stopped the service and selected the radio button for the "Local system account" and restarted everything worked.

There is a lot going on here that I don't understand: Why did GetEffectiveRightsFromAcl() fail? Why did my workarounds with sc fail? How is "Local system account" different from "NT Authority\Local Service"? If I had my way we would do all of our development on Linux. Oh well.

Thanks,

[bernard]

Hi Edward,

Your work-around is a bit extreme! Local Service is a low-privilege built-in account while Local System has Admin rights. See Service User Accounts (Windows).

You could probably use the unmodified iceserviceinstall and specify --ObjectName=LocalSystem to get the same behavior.

The main question is why is GetEffectiveRightsFromAcl with LocalService failing with this strange error on your XP systems ... I have no idea!

Best regards,
Bernard

[Edward Bishop]

Hi Bernard,

Here is the result when I add --ObjectName=LocalSystem to the unmodified iceserviceinstall command:

C:\>iceserviceinstall icegridnode c:/foogrid/collocate2.cfg --ObjectName=LocalSystem
Error: Could not retrieve Security ID for LocalSystem: The trust relationship between the primary domain and the trusted domain failed.
Press any key to continue . . .

Searching the web, it seems this is a common error and that my PC, or my account. needs to be deleted and then re-added to the Domain. Or something.

I am very reluctant to get our system administrators involved. My workaround, returning immediately from grantPermissions(), is adequate for now.

Thanks again,

[jharriot]

Hi Edward,

Sometime ago I had problems installing icegrid (Ice 3.3.1) as a service.
I can't recall the exact details, but I had threee problems:
1. Insufficient rights to install the service on some PCs (Windows XP) as LocalService.
2. An IceGridNode running on a Linux platform was unable to connect to the IceGridRegistry running as Windows Service.
3. An the show stopper was not being able to launch a Windows app with a HMI using IceGrid.

Admittedly I did not spend a lot of time trying to resolve the issues. However in the end I simply added some code to an existing "Utility" that spawns icegridnode (collocated mode) as a standard process. The "Utility" gets run whenever the PC boots and spawns the icegridnode process automatically. The utility appears as a system tray icon, which allows me open a form and perform housekeeping functions, as well as start and stop IceGrid manually.

Cheers John