Re: Can't determine if a file exists

From: Nikolai Evseev (NikolaiEvseev_at_discussions.microsoft.com)
Date: 08/15/05

  • Next message: Eric Dan: "RSACrypto.. - can I reuse the private key and more..?" 
    Date: Mon, 15 Aug 2005 02:00:04 -0700

    Thanks Paul for pointing at the article. I've tried the default
    authentication scenario, when <processModel userName="machine"/>. I've added
    NT AUTHORITY\ANONYMOUS LOGON user to the permissions list for the bloody
    shared folder, but getting the same picture at the end - no access. As far as
    I understand, according to the above mentioned article, IIS should delegate
    ASPNET user to the workgroup machine, which should appear as ANONYMOUS LOGON
    on that machine.

    "Paul Clement" wrote:

    > On Fri, 12 Aug 2005 05:07:03 -0700, "Nikolai Evseev" <NikolaiEvseev@discussions.microsoft.com>
    > wrote:
    >
    > ¤ Thanks Nicole for your reply,
    > ¤
    > ¤ The target shared folder (call it \\PCWKG\SHAREDFOLDER) is on another
    > ¤ machine. My machine (PCDOM1), on which I am running the browser is also the
    > ¤ IIS. Presume that PCDOM1 is in the corporate domain, and PCWKG is in it's own
    > ¤ workgroup and not in the corporate domain. If IIS\website authentication is
    > ¤ set to Windows Authentication then it works, if Anonymous then not. But if I
    > ¤ login as myself (with the same user name and password) on PCDOM2 and start
    > ¤ the browser on it then it's not working as well. I was thinking that the
    > ¤ reasong could be that my own account doesn't have access to the shared
    > ¤ folder, but how can I give access on a shared folder to the domain user if
    > ¤ the PCWKG is not on the domain?
    > ¤
    >
    > I think the larger problem is one of delegation. Authenticating locally (on your web server)
    > shouldn't pose a delegation issue as long as sufficient permissions are enabled on the workgroup PC
    > (as you have demonstrated).
    >
    > However, a user authenticating from a browser on another machine, using Integrated Windows security,
    > will not be able to have his credentials delegated through IIS. NTLM handles the authentication
    > under this configuration and IIS never receives encrypted credentials. Implementing Kerberos allows
    > delegation to occur under this scenario but I don't know whether it's possible with a machine that
    > is not in the domain. There are some workarounds, when using Integrated Windows security, that you
    > may find suitable in the below article. It's a good read if you need to understand how this stuff
    > works.
    >
    > Basic authentication would be another alternative since impersonation and delegation of clear text
    > credentials is allowed.
    >
    > ASP.NET Delegation
    > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsent7/html/vxconaspnetdelegation.asp
    >
    >
    > Paul
    > ~~~~
    > Microsoft MVP (Visual Basic)
    >

  • Next message: Eric Dan: "RSACrypto.. - can I reuse the private key and more..?"

    Relevant Pages

    • Re: Cant determine if a file exists
      ... Presume that PCDOM1 is in the corporate domain, and PCWKG is in it's own ... set to Windows Authentication then it works, ... but how can I give access on a shared folder to the domain user if ... I think the larger problem is one of delegation. ...
      (microsoft.public.dotnet.security)
    • Re: PROBLEM: ASP on IIS 5 secured via "Windows Integrated Authentication" accessing "
      ... I have two virtual directories on same server with Integrated ... If i use basic authentication, ... as .NET framework config file) as well as Delegation as specified by the ... > could do whatever you want in your ASP page on behalf of the Domain Admin. ...
      (microsoft.public.inetserver.iis.security)
    • Re: Application Flow / security issues
      ... just disable impersonation and make sure your process identity (the app ... If you have to delegate and can't configure Kerberos delegation, ... You want to use the credentials of the authenticated web app user to ... Kerberos authentication to the web app is enabled and working ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: Issue: Virtual Directory to UNC
      ... Authentication with HTTPS/SSL. ... I now understand the reason behind the delegation ... The purpose of this server is to access I just want to access one machine ... > Just because a remote user authenticated to the web server, ...
      (microsoft.public.inetserver.iis.security)
    • Re: Access denied ( From one site to another, that is in another server)
      ... and perform Kerberos authentication. ... Web Server: ... Active Directory - Delegation: ... the Aspnet_wp.exe process runs under a computer account named ...
      (microsoft.public.dotnet.framework.aspnet.security)