Re: Resetting IUSR user token

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 06/30/05 

Date: Wed, 29 Jun 2005 15:38:09 -0700

Ah, ok. Well, glad the obvious solution is working out for you. :-) 

-- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Ard" <Ard@discussions.microsoft.com> wrote in message
news:E245B2A4-A8EC-4C03-9EB0-FD489F14EDD4@microsoft.com...
Thanks for your reply
I think in this case granting authenticated users direct access to the
folder would be the way to go: so thanks for that suggestion. (It seems so
obvious: why didn't I think of that one myself ??)
As for the design of the application: it's one of these things that seem to
happen to applications that exist for a number of years in a permanent state
of development by different developers. (Still not a valid excuse, but it
gets me of the hook doesn't it :-)
Gr. Ard
"David Wang [Msft]" wrote:
> IIS does not expose any programmatic access for users to insert/invalidate
> any of its internal caches, so you will have to find a workaround. I do
not
> understand why you ACL the folder to only the new local group -- why don't
> you ACL the folder to also include Authenticated Users or IUSR since the
> effective ACL does not change -- but now you do not get affected by the
> token cache.
>
> And I still think that your design of inserting IUSR into various Windows
> user groups to be weird. It is not clear to me what you are actually
gaining
> vs what I had described earlier. Why are you adding IUSR to various user
> groups?
>
> The real issue here is that when a user account's group membership
changes,
> there is no way for IIS to get a change notification -- or else the token
> cache would just work. Giving programmatic access for users to
> insert/invalidate the token cache is clearly not the solution; it is just
> one of many possible workarounds.
>
> -- 
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "Ard" <Ard@discussions.microsoft.com> wrote in message
> news:F57CE627-8327-4F5D-A7DF-9526173F788A@microsoft.com...
> Folks,
>
> Maybe someone can help me out here.
>
> I'm working on an ASP web application on a w2k server with iis 5.
> The application dynamically creates folders and uses adsi to create local
> windows groups that have access to these folders.
> Because the group 'authenticated users' is member of one of the new
windows
> groups, the IUSR account should have access to the new folder. But because
> the IUSR user token is cached for 15 mins anonymous users can't
immediately
> access this folder, but have to wait untill the TimeToLive for the IUSR
> token
> has expired.
>
> Because of the performance penalty i don't want to reduce the UserTokenTTL
> for all users. (The possible solution described in KB152526.)
>
> Is it possible to force the expiration of the IUSR user token? If I can
> expire just this one token immediately after creating the windows groups,
> the
> problem should be solved.
>
> Does anyone know a way to accomplish this?
>
>
>
>
>
>
>

Relevant Pages

  • Re: Resetting IUSR user token
    ... I think in this case granting authenticated users direct access to the ... folder would be the way to go: ... > And I still think that your design of inserting IUSR into various Windows ... > windows groups that have access to these folders. ...
    (microsoft.public.inetserver.iis.security)
  • Re: File System Object Lockdown...possible?
    ... When I simply add the IUSR account to the folder and DENY write acess, ... > global.asa and IWAM have very little to do with the situation. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Resetting IUSR user token
    ... IIS does not expose any programmatic access for users to insert/invalidate ... understand why you ACL the folder to only the new local group -- why don't ... And I still think that your design of inserting IUSR into various Windows ... cache would just work. ...
    (microsoft.public.inetserver.iis.security)
  • Re: 401.1 Question
    ... > At the point where Anonymous Access is enabled, the IUSR_account ... > The IUSR user account is set that the password never expires and that the ... > "WC Justice" wrote in message ... >> The permissions on the site folder are inherited from the WebSites folder ...
    (microsoft.public.inetserver.iis)
  • Re: Filesystemobject security IIS question...
    ... process identity as well -- so you can lock an application to an identity no ... IIS anon web sites run as IUSR user. ... Full - this folder, sub folders and files ...
    (microsoft.public.inetserver.iis.security)