Re: Restricted permission on subfolder

wich has nothing to do with authorization...

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Because if you don't turn impersonation on, then your worker process
is going to run under ASPNET process. the thread will not impersonate
as the windows user.

"Dominick Baier [DevelopMentor]"
<dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:4580be63194eea8c7e5ee2e295bdf@xxxxxxxxxxxxxxxxxxxxx

why?

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Enabled this line..

<identity impersonate="true"/>
"Magnus Blomberg" <magnus.blomberg@xxxxxxxxxx> wrote in message
news:eI1$%23rdFGHA.344@xxxxxxxxxxxxxxxxxxxxxxx
Hello!
I have a intranet website with one unrestricted part (root) and one
part in a subfolder which only could be used by some users.
Here is my web.config (almost everything):
<configuration
xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0";>
<connectionStrings>

.........

</connectionStrings>

<system.web>

<roleManager enabled="true"          cacheRolesInCookie="true"

</roleManager>

<!--<identity impersonate="true"/>-->

<authentication mode="Windows"/>

<authorization>

<allow users="*"/>

</authorization>

</system.web>

<location path="editmode">

<system.web>

<authorization>

<allow roles="pd03\MedarbetareEditors"/>

<deny users="*"/>

</authorization>

</system.web>

</location>

</configuration>

My idea is that everyone should be able to access all pages in my
application root. Only those in the MedarbetareEditors group should
be
able to access pages in my subfolder "editmode".
I got this to work in my development web where I have an older
(beta)
of DotNet 2.0. Now I'm using the released version of DotNet 2.0.
Looking in IIS I have DotNet version 2.0.50727. For the application
root I have anonymous users and Integrated Windows Authentication
enabled. For the editmode folder I have only Integrated Windows
Authentication enabled.
I use the adress or the client IE sites set up so that the client
sees the site as Local Intranet. Everything works when accessing the
root pages, but when accessing the subfolder pages I get a logon
question, and using an AD account which is a member of the
pd03\MedarbetareEditors group doesn't give the access to the pages.

What could be wrong???
Regards Magnus



.

Relevant Pages

  • Re: About ASP.Net Impersonation
    ... Dominick Baier - DevelopMentor ... authenticated with integrated Windows auth, you need to properly configure Kerberos delegation. ... Our asp.net app needs to access other servers from our IIS servers. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Kerberos S4U problem
    ... Dominick Baier - DevelopMentor ... does it work from Windows XP or only from Server? ... I have been attempting just this, I have set my local account to have permission to act as part of the operating system and have flaged it as trusted for delegation, however whenever I use this function I get a System.Security exception with the message "Incorrect Function", I get the exact same result if I call LsaLogonUser using the Kerberos S4U format. ...
    (microsoft.public.dotnet.security)
  • Re: Mixed Mode (Forms & Windows) Authentication
    ... Dominick Baier, DevelopMentor ... page will convert the Windows credentials to a FormsAuth ... Windows authentication with the existing Forms authentication so ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: System.Diagnostics.Process.Start fails on windows server 2003
    ... Dominick Baier - DevelopMentor ... the process returns process.ExitCode == 0 but executing any process ... with System.Diagnostics.Process.Start on windows xp works fine. ...
    (microsoft.public.dotnet.security)
  • Re: Of mice and men
    ... >> This is no different to many environments OS - even windows. ... With their own account, and guest accounts set ... > root password, but they cannot "run as root" without it. ... > it will tell you that you do not have disk access. ...
    (comp.lang.cobol)