TechnitiumSoftware/DnsServer · error · DnsWebServiceException

Access was denied.

Error message

Access was denied.

What it means

DnsWebServiceException thrown by GetSessionUser when standardOnly is true but the session type is not UserSessionType.Standard. Some operations require a real interactive user session and reject API/cluster/SSO token types that do not represent a standard login.

Source

Thrown at DnsServerCore/DnsWebService.cs:2630

            UserSession session = context.GetCurrentSession();

            if ((session.Type == UserSessionType.ClusterApiToken) && _clusterManager.ClusterInitialized)
            {
                //proxy call from cluster node 
                string actingUsername = context.Request.GetQueryOrForm("actingUser", null);
                if (actingUsername is null)
                    return session.User;

                User actingUser = _authManager.GetUser(actingUsername);
                if (actingUser is null)
                    throw new DnsWebServiceException("No such user exists: " + actingUsername);

                return actingUser;
            }
            else
            {
                if (standardOnly && (session.Type != UserSessionType.Standard))
                    throw new DnsWebServiceException("Access was denied.");

                return session.User;
            }
        }

        #endregion

        #region tls

        private void StartTlsCertificateUpdateTimer()
        {
            if (_tlsCertificateUpdateTimer is null)
            {
                _tlsCertificateUpdateTimer = new Timer(delegate (object state)
                {
                    if (!string.IsNullOrEmpty(_webServiceTlsCertificatePath))
                    {
                        string webServiceTlsCertificatePath = ConvertToAbsolutePath(_webServiceTlsCertificatePath);

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Authenticate as the user with a standard login (/api/user/login) and use that session for standardOnly endpoints.
2. Use a different endpoint that accepts the token session type, if one exists.
3. Confirm the session type expected by the endpoint and obtain the matching token kind.

Example fix

null

// Use a standard login session for standardOnly endpoints
if (session.Type != UserSessionType.Standard)
    throw new UnauthorizedAccessException("This endpoint requires a standard session.");

static bool IsStandardSession(UserSession session) => session.Type == UserSessionType.Standard;

catch (DnsWebServiceException ex) when (ex.Message == "Access was denied.")
{
    // prompt the user to log in interactively
}

When it happens

Trigger: Calling an endpoint that passes standardOnly=true while authenticated with a non-standard session (e.g. a ClusterApiToken, single-use token, or other token type). The caller asked for a standard user but the session is a service token.

Common situations: Using an API token or cluster token to hit an endpoint that requires a human/standard session; scripting a UI-only flow with a service token; session type downgrade after token reissue.

Related errors

• Invalid token or session expired.
• Failed to read 'Zones' permissions: auth.config file is prob
• Failed to find 'Administrators' group: auth.config file is p
• Failed to find 'DNS Administrators' group: auth.config file
• No such user exists: {actingUsername}

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/955c326ca6ea1f33. Report an issue: GitHub.