Re: Service Account replaced by IUSR ??

It looks like the IIS anonymous user is being impersonated for some reason
here. That should be the only reason why that user would get used at all.
Can you see any reason how that might have happened? Is anonymous enabled
in the application at all?

Out of curiosity, why are you enabling for delegation if you don't plan to
delegate? Based on what I read below, it sounds like you just want to use
the fixed process account for accessing remote resources, so delegation
should not matter. As such, you should also able to avoid impersonation as
well since you would generally only impersonate if you need to delegate or
access local resources with the security context of the authenticated user.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Erwin@ODS" <erwin@xxxxxxxxxxxxxxxxxxx> wrote in message
news:%23GzsZGasHHA.3736@xxxxxxxxxxxxxxxxxxxxxxx
Hi,
Could anyone help me with this.
I am testing a .Net 2 application that creates a user in AD. It also has
to create a shared folder on a remote server.
I'm testing this on a Windows SBS 2003 machine, taking the same server as
"remote" server, by using the UNC path when creating the directory.

Now, in order to avoid impersonation I did the following :
- create a service account, register it in AD using the setspn.exe tool
described in article
http://msdn2.microsoft.com/en-us/library/ms998358.aspx.
- giving the service account administrator rights (only for testing
purposes, this will be graded down in production)
- checking the "trust account for delegation" option in the account
- create a separate application pool in IIS 6 only for this application.
- setting the identity for this AppPool to the newly created user

So far, everything works fine, and I succeed in creating the user in AD.
But the application breaks down when I want to create the folder, for the
reason that the app doesn't have access rights to the folder.
It will only work when I use impersonation :
- either to the specially created service account
- or to the web user, if he has administrator rights.

But the whole idea of creating a service account was to avoid
impersonation !

I decided to audit the parent directory in which the user directories
should be created. And this is what I got as event (I snipped some lines
for briefness) :

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: MYSERVER
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: IUSR_MYSERVER
Domain: IQS
Logon Type: 8
Logon Process: Advapi Authentication Package: Negotiate
Workstation Name: MYSERVER
Caller User Name: adtester

What boggles my mind is that the user is still IUSR_MYSERVER in stead of
the specially created service account "adtester" !

Do you have any idea what's going on here or am I missing something ?

Thanks !


.

Relevant Pages

  • Re: SetPassword access denied
    ... That said, I think one thing worth pointing out is that in both cases here, your code is supplying credentials to the DirectoryEntry constructor. ... the identity of the current thread (established either via impersonation or using the process token without impersonation) is NOT the account that is used for performing remote activities in the directory. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: Windows Server 2008 impersonation.
    ... It is often cleaner just to set up a separate app pool for this app on the server, run it as the admin user, add the user to the appropriate IIS_WPG group and get rid of the impersonation AND the hard coded credentials. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... > intermittent failures under Windows Server 2008 x64. ... > Dim tempWindowsIdentity As WindowsIdentity ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Very slow processing on SSAS2005 Std (Core Duo, MSSQL on same box, different disks for DB and AS
    ... D'oh - that's the last time I provide credentials for impersonation. ... Setting the impersonation to 'Use Service Account' sorted it, ... When I process this cube, it takes 2 mins+, the majority of the time being ...
    (microsoft.public.sqlserver.olap)
  • Re: .NET Components in COM+
    ... If you need the assembly to run under a different identity than the code remoting into it use WindowsIdentity tokens to impersonate a user. ... Basically use the LogonUser function from the win32 api and use the token returned in the impersonation: ... > told the the only reason that the component is in COM+ is that it is able to ...
    (microsoft.public.dotnet.distributed_apps)
  • Re: Azman: AzAuthorizationStoreClass.Initialize
    ... ADAM on the WinServer 2003 box. ... I had a service account created and we are doing an impersonation. ... in ADAM and thru azman. ...
    (microsoft.public.windows.server.active_directory)