Re: Service Account replaced by IUSR ??

It looks like the IIS anonymous user is being impersonated for some reason
here. That should be the only reason why that user would get used at all.
Can you see any reason how that might have happened? Is anonymous enabled
in the application at all?

Out of curiosity, why are you enabling for delegation if you don't plan to
delegate? Based on what I read below, it sounds like you just want to use
the fixed process account for accessing remote resources, so delegation
should not matter. As such, you should also able to avoid impersonation as
well since you would generally only impersonate if you need to delegate or
access local resources with the security context of the authenticated user.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Erwin@ODS" <erwin@xxxxxxxxxxxxxxxxxxx> wrote in message
news:%23GzsZGasHHA.3736@xxxxxxxxxxxxxxxxxxxxxxx
Hi,
Could anyone help me with this.
I am testing a .Net 2 application that creates a user in AD. It also has
to create a shared folder on a remote server.
I'm testing this on a Windows SBS 2003 machine, taking the same server as
"remote" server, by using the UNC path when creating the directory.

Now, in order to avoid impersonation I did the following :
- create a service account, register it in AD using the setspn.exe tool
described in article
http://msdn2.microsoft.com/en-us/library/ms998358.aspx.
- giving the service account administrator rights (only for testing
purposes, this will be graded down in production)
- checking the "trust account for delegation" option in the account
- create a separate application pool in IIS 6 only for this application.
- setting the identity for this AppPool to the newly created user

So far, everything works fine, and I succeed in creating the user in AD.
But the application breaks down when I want to create the folder, for the
reason that the app doesn't have access rights to the folder.
It will only work when I use impersonation :
- either to the specially created service account
- or to the web user, if he has administrator rights.

But the whole idea of creating a service account was to avoid
impersonation !

I decided to audit the parent directory in which the user directories
should be created. And this is what I got as event (I snipped some lines
for briefness) :

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: MYSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: IUSR_MYSERVER
Domain: IQS
Logon Type: 8
Logon Process: Advapi Authentication Package: Negotiate
Workstation Name: MYSERVER
Caller User Name: adtester

What boggles my mind is that the user is still IUSR_MYSERVER in stead of
the specially created service account "adtester" !

Do you have any idea what's going on here or am I missing something ?

Thanks !


.

Relevant Pages

  • Re: Very slow processing on SSAS2005 Std (Core Duo, MSSQL on same box, different disks for DB and AS
    ... D'oh - that's the last time I provide credentials for impersonation. ... Setting the impersonation to 'Use Service Account' sorted it, ... When I process this cube, it takes 2 mins+, the majority of the time being ...
    (microsoft.public.sqlserver.olap)
  • Re: .NET Components in COM+
    ... If you need the assembly to run under a different identity than the code remoting into it use WindowsIdentity tokens to impersonate a user. ... Basically use the LogonUser function from the win32 api and use the token returned in the impersonation: ... > told the the only reason that the component is in COM+ is that it is able to ...
    (microsoft.public.dotnet.distributed_apps)
  • Re: Azman: AzAuthorizationStoreClass.Initialize
    ... ADAM on the WinServer 2003 box. ... I had a service account created and we are doing an impersonation. ... in ADAM and thru azman. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Service Account replaced by IUSR ??
    ... I can't think of a reason why the IUSR account would get used here then. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... "By using impersonation, ASP.NET applications can execute code or access ... created when you enable impersonation allow you to access local resources ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Impersonation and LinkLabels result in SecurityException
    ... Windows-user. ... The impersonation token is created with a P/Invoke on ... registry access fails when impersonating, ... dwComponentID, Int32 reason, Int32 pvLoopData) ...
    (microsoft.public.dotnet.languages.csharp)