Application pool security

hi,

I'm not getting the results I expected when setting up authorization in
my web service. I have a web application that runs under an application
pool identity (with Windows authentication). This application then
calls a web service which is also setup to run under the same
application pool identity (a valid domain account) with Windows
authentication (anonymous user turned off in IIS).

I am getting status 401 unauthorized. At the moment my authorization
section has allow users=* in both the application and the web service.
I was assuming that the application would call the web service under
the Application pool identity and be authorized (as it is a windows
domain account).

If I could get this bit to work I would then change my web service
authorization section to only "allow users=serviceaccount" which will
ensure that only specific web applications will consume it rather than
users being able to get to the data directly.

When I switch the web service to allow anonymous user it works fine but
obviously this doesn't do what I want. Is it because of the way that
the account has been setup by the domain administrators? Could this be
why?

TIA
Phil

.

Relevant Pages

  • Re: Application pool security
    ... calls a web service which is also setup to run under the same ... application pool identity (a valid domain account) with Windows ... authentication (anonymous user turned off in IIS). ... At the moment my authorization ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: WebService Windows Authentication ASP.NET 2.0
    ... and if it is granular enough to set the authorization on file basis - use a location element for individual AuthZ settings for the .asmx files. ... I'm not a big fan of using the PrincipalPermission as it generally ... The web service is only ...
    (microsoft.public.dotnet.security)
  • Running Webservice under aspnet entity....
    ... One web service I use does ... that 'aspnet' entity lacks the authority to connect. ... from work PC- it goes with 'aspnet' id and fails MQ authorization. ... settings I have in IIS under default web site - properties - Directory ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Authorization during WS-SecureConversation secured calls
    ... What are the options/best practices for authorizing individual Web Service ... WS-SecureConversation machinery is being set up. ... This seems like it should be a fairly common usage pattern, ... I've read so far appears to discuss WS-SecureConversation and authorization ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • asp.net impersonation
    ... When a Web Service is configured to use windows authentication with no ... When I turn on impersonation and add authorization for user domain ...
    (microsoft.public.dotnet.framework.aspnet.security)