You receive a 403 Access Denied error when attempting to activate the Delegation Web Components or Membership Delegation Template Site features.

Cause

This error occurs because the Windows account used for the web application's application pool Identity does not have permissions for the resource directories within the site's virtual directories for both the Default (Windows) zone and/or the FBA (Extranet) zone.

To resolve, go to IIS Manager and right click on the web site for the FBA (Extranet) zone and click Properties. Go to the Home Directory tab and make note of the Application Pool used for this site. Then go to the Application Pools node and right click on the corresponding Application Pool and click Properties. Go to the Identity tab and make note of the Windows account being used for the Identity.

Browse to the virtual directory for the web site (as found in the Local Path property on the Home Directory tab of the web site's Properties page in IIS) and find the directory App_GlobalResources. Right click on the file and click Properties. On the Security tab, click Add and then type in or find the Windows account used for the application pool's Identity and give it Modify permissions.

Repeat the process for the Default (Windows) zone.

Reset IIS and you should now be able to activate the feature successfully.