Re: IIS6.0 & Shared Folders

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 01/29/05 

Date: Sat, 29 Jan 2005 01:57:08 -0800

Please read this URL on how UNC shares work. You did not configure what you
think:
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/remstorg.mspx

What you want is Pass-Thru authentication to restrict access based on the
authenticated user, but you configured something that allows any
authenticated user to access resources.

What you basically did was configure IIS to access any NAS resource when
requested via this website as Domain\IUSR_WEB. You then allowed only
Integrated authentication, meaning that only authenticated users can access
this website, and when they access NAS resources, these users do so as
Domain\IUSR_WEB (as you configured). Since you already gave read access to
Domain\IUSR_Web, that is why they have read access to it.

I suggest you configure Pass-Thru authentication so that theremote
authenticated user's identity is used on the NAS resource to determine
access. Clearly, if you want to restrict access to resources, you must lock
that file/folder for a particular user and do NOT include any other
identity.

As the URL will mention, Pass-Thru authentication requires delegation, which
does not work with Integrated authentication unless the machines are in a
domain and you use protocol transitioning to use Kerberos on the backend to
make delegation work. 

-- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"crino" <cseverini@aditusnet.it> wrote in message
news:VPPJd.456806$b5.21779376@news3.tin.it...
Hi at all!
I've a little problem.
I've a web site with storage on a shared folder on a NAS.
The folder is shared to user's domain (Domain\IUSR_WEB).
The web site is configured to connect to the folder with (Domain\IURS_WEB).
The user is used for anonymous access too.
all work propertly, but i have to lock some file or folder for only
determinate users. So i have grant to user's domain the permission and in
IIS
configuration, under the tab 'protection directory', disabled 'anonimous
access' and i've leave 'authentication integrated windows'.
Every users' domain can still access to the files/folders....why??!!! (also
if the user don't have the permission on them!)
Any clue will be appreciated!
Thanx in advance ;))
/crino

Relevant Pages

  • Re: Multi Level Forms Authentication Help DESPERATELY NEEDED!
    ... Forms authentication supports this functionality. ... You can have a web.config in each folder that specifies who's allowed in. ... > to access certain files on the web site to an ASP .NET Forms ... > while still managing access to the aforementioned subdirectories. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Domain Name Forging On Authentication Prompt
    ... Domain Name Forging On Authentication Prompt ... To bypass IE domain restrictions the ip of the protected folder needs ... [End Code Sample] ...
    (Vuln-Dev)
  • RE: Need to restrict remote users to access only specific folder(s
    ... This sounds like an authentication problem -- or a firewall problem. ... go through the IIS logs to look for problems authenticating or on the service ... user via file access permissions when working internally. ... Suggestions for better folder level access via RWW? ...
    (microsoft.public.windows.server.active_directory)
  • Re: How to securely publish a Click Once application
    ... the folder hierarchy in tact. ... Forms authentication, deny all anonymous users and the mime setting to add ... non-asp.net apps to the forms authentication protection looks like the right ... for any updates - but because the update location doesn't allow ...
    (microsoft.public.dotnet.framework)
  • Re: Authentication login screen appears on both frames of the framset
    ... This section sets the authentication policies of the application. ... This section sets the authorization policies of the application. ... Application-level tracing enables trace log output for every page ... folder / file to set ...
    (microsoft.public.dotnet.framework.aspnet)