Re: authentication and impersonation question

Hi,

yeah that can be confusing:


For asp.net applications:
1) when asp.net impersonation is not set, authentication by IIS
happens
first (if anonymous access is enabled then identity is the IUSR_
account),
but any resource access (read/write for files etc) is done by the
asp.net
process account (the IIS application pool process account for IIS 6,
network
service). This means NTFS permissions need to be set for that asp.net
process (or IIS app pool process) account to control access to
resources.
True/false? correct me if/where wrong?

Control access is too much. You need read/read execute/list folder contents for the worker process
In addition the FileAuthorizationModule checks if read access is allowed on the requested resource for the client (either the auth client or IUSR).


2) when asp.net impersonation *is* set, authentication by IIS happens
first (if anonymous access is enabled then identity is the IUSR_
account), and any resource access (read/write for files etc) is done
by the IIS account, IUSR_ if anonymous. This means NTFS permissions
need to be set for that IUSR_ account to control access to resources.
True/false? correct me if/where wrong?

I don't think I have this straight yet.


right. Again read/rx/lfc is enough.


.

Relevant Pages

  • Re: Anonymous Account not working
    ... the Iusr_ you are using may have been defined before the final ... IIS install on that box. ... I think the problem may be with the local account. ... built the server there was another server that was named WEB02, ...
    (microsoft.public.inetserver.iis.security)
  • Re: IWAM out of sync (DCOM error) 10004
    ... password that is cached in the IIS Metabase for the IWAM and IUSR accounts. ... This should show you whether the password is being changed in the metabase. ... If you reset the password on the domain account, ... and IIS is set to control the IUSR password? ...
    (microsoft.public.inetserver.iis.security)
  • Re: Experiencing Sporadic HTTP Error 401.1 - Unauthorized errors on IIS
    ... I created a user identical to IUSR and set this user as the anonymous user ... account in IIS Web Sites. ... All web sites and web pages now return 401.1. ... Access to all IIS resources ...
    (microsoft.public.inetserver.iis)
  • Re: IIS 6.0 Security, Internet Guest Account
    ... What you need to do is to give the right password to the IUSR account (which ... IIS attempts to use another ... >> changed the Windows user account for anonymouse access ...
    (microsoft.public.inetserver.iis.security)
  • Re: authentication and impersonation question
    ... control access, not to assign permissions to the aspnet process or IUSR_ ... which scenarios what particular account needs ntfs access, ... on the requested resource for the client. ...
    (microsoft.public.dotnet.framework.aspnet.security)