Re: Security issues with Win2003 and ASPNet app

From: RichardF (noone_at_nowhere.com)
Date: 04/28/05

  • Next message: Dominick Baier [DevelopMentor]: "Re: Securing an ASP.Net application" 
    Date: Thu, 28 Apr 2005 11:11:40 -0500

    Thanks for the help, I will give that a go. (Assuming I can figure
    out how to add a App Pool!)

    Once I do this, how do I then configure permssions on the SQL server
    and Image server machines?

    RichardF

    On Thu, 28 Apr 2005 08:26:20 -0700, Dominick Baier [DevelopMentor]
    <dbaier@pleasepleasenospamdevelop.com> wrote:

    >Hello RichardF,
    >
    >you can configure the identity of your web service using the Application
    >Pool feature of IIS6.
    >
    >Add a new AppPool - give it an identity (local or domain) - and add the web
    >service application to the AppPool (WebApp properties)
    >
    >Add the account to IIS_WPG and give it access to \windows\microsoft.net\framework\v\temporary
    >asp.net files\ and \windows\temp
    >
    >HTH
    >
    >---------------------------------------
    >Dominick Baier - DevelopMentor
    >http://www.leastprivilege.com
    >
    >> I have an ASP.NET Web Service and Web Site. It accesses a SQL
    >> database for its data and retrieves images from another server.
    >>
    >> There are 4 servers all running Win 2003 as follows...
    >>
    >> 1 - Domain Controller
    >> 2 - SQL Server
    >> 3 - IIS Server (runs Web Service and Web Site)
    >> 4 - File Server (stores all the image files)
    >> I am having lots of issues with permissions because my Web Service is
    >> running as a user under a LOCAL group IIS_WPG on the IIS Server and I
    >> don't know how to give it the necessary permissions to access the SQL
    >> Server and the Images on different machines.
    >>
    >> I think what I need to do is create a Domain Account, give it the
    >> appropriate permissions and then somehow get my Web Service to run
    >> using that user account. I did try this using 'impersonate' but then
    >> it appeared i didn't have permission to tun ASP.NET stuff!
    >>
    >> Can anyone give me tips on how to accomplish this, or point me to a
    >> resource that explains how I can accomplish this.
    >>
    >> Thanks for any help
    >>
    >> RichardF
    >>
    >
    >

  • Next message: Dominick Baier [DevelopMentor]: "Re: Securing an ASP.Net application"

    Relevant Pages

    • Re: Anyone seen this error before
      ... I am assuming that you have WSS installed on this server, ... override it in your web.config for the web service to a level that allows ... SQL permissions. ... > CodeAccessPermission demand, StackCrawlMark& stackMark, Int32 checkFrames, ...
      (microsoft.public.biztalk.general)
    • Re: knowing wich previleges i have
      ... installations on the server are against the requirements of my ... In the web service, you ... check the permissions on servers that have the web service deployed. ... GetPermissionCollection web method. ...
      (microsoft.public.sharepoint.portalserver.development)
    • Re: Security issues with Win2003 and ASPNet app
      ... you can configure the identity of your web service using the Application ... > running as a user under a LOCAL group IIS_WPG on the IIS Server and I ... > don't know how to give it the necessary permissions to access the SQL ... > I think what I need to do is create a Domain Account, ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • RE: initialize COM within a web service
      ... The likely culprit is permissions. ... Administering just about any server ... >I'm currently trying to use API's in Microsoft Virtual Server 2005. ... >initialize COM just fine from anything other then a web service whihc is ...
      (microsoft.public.dotnet.framework.aspnet.webservices)
    • Re: Security issues with Win2003 and ASPNet app
      ... After installing my web service and web site, ... I right clicked the app pool, went to the identity tab and changed it ... Then I added that domain user account to the IIS_WPG group. ... >> don't know how to give it the necessary permissions to access the SQL ...
      (microsoft.public.dotnet.framework.aspnet.security)