I am attempting to set up an IIS 6.0 application running on Windows Server 2003 to use impersonation in order to avoid having to give users direct read/write access to the shared folders where the DB and web pages are stored. Can anyone provide me with details of how this can be set up to work in conjunction with Windows Integrated Authentication?
So far, I can tell that the web.config file (not sure whether it's the correct one) has the two lines mentioned on this thread (Impersonation in IIS 7.0) to allow impersonation and use the Windows logon method. However, users are still prompted for a logon and then told they are not authorized to view web pages. They can view pages if we turn anonymous logon "on", but then their user credentials aren't passed on to the site and therefore they can't access most of it.
I'm fairly inexperienced, so I'm a bit lost here. Thank you very much in advance for the help!
Thanks to intervention from Microsoft (definitely worth the flat fee they charge per incident), we were able to identify the problem. Instead of using the network path to identify the website location on the "Home Directory" tab of the IIS properties, we were using the local drive path. That was all that needed to be changed.
Once we switched to the network path and added a dedicated service account to "Connect As...", impersonation started working right away. Users pass their logged on credentials via integrated authentication (no logon required) and the service account takes care of executing their actions on the database file.
Access to the shared folder is limited to a brief list of administrators, and data access on the web application is limited based on user names.
If anyone is stuck with this and needs help, let me know!
Related
I have installed Umbraco on my local machine but I have some questions regarding IIS and permissions if someone can help verify that I understand it all correctly. My environment is as follows
• Windows 7 Pro OS
• IIS 7.5 - I have set up a new site in IIS which has the identity Application Pool Identity for the app pool
• Umbraco v7.3.0 – The application files are located in C:\Users[myUsername]\Documents\Visual Studio 2013\Projects\InstallingUmbracoDemo\InstallingUmbracoDemo
Is the following process/understanding correct?
Add a new website in IIS and the application pool name is automatically updated to reflect my sites name.
By default this will use the identity ApplicationPoolIdentity which means that my new sites worker process (w3wp.exe) will run in an application pool that has the same name as my website in IIS
By default when I created my new site it will be added to a user group called IIS_IUSR
If I try to access my application files (that are in a folder that doesn’t not grant permission to the IIS_IUSR user group) it will mean IIS can’t access the resources until I grant the IIS_IUSR user group access
The IUSR user group is used for anonymous access and for anything anonymously requesting my website it will be added to this group
As Umbraco needs to access the internet to install the application I need to a grant permission to IUSR to allow it to do so
Partly because I don’t quite fully understand everything I’m quite concerned about the security of granting permission to IUSR on the root folder where the application files reside. Once Umbraco has installed can this user groups full permission be revoked? Does it require full permission?
I have found the following resource https://our.umbraco.org/wiki/reference/files-and-folders/permissions but if anyone else can provide an overview regarding permissions and the ISUR & IIS_ISUR work and more importantly whether I am understanding this process correctly.
Apologies if I am way of the mark – I’m just trying to learn and ensure i fully understand everything.
Many thanks
Paul
Umbraco will need permission to write files to certain folders on the server as the content/media cache, examine indexes, logs, media, etc are all disk file based.
Have you tried adding the specific AppPool user to the folders and granting permission to it?
Its usually:
IIS AppPool\MyAppPoolNameInIIS
I have had cases where that isn't allowed and I have to use IUSR, but generally this works and seems more specific and contained.
My company has a MediaWiki setup which we are looking to make [partially] client accessible. Ideally each client would be able to see only their own page. Our wiki requires the user to be logged into view or edit, and we have the LDAP plugin (This one, specifically) so we can use our Active Directory credentials.
I see this question has come up before a few years ago, but I didn't see an question dealing with LDAP in particular. Can we manage a specific AD account if we give clients one on our domain for this purpose? Alternatively, is there a way to give clients a login directly into the wiki (sort of like logging locally into the computer, instead of the domain), that we could control the access rights of?
For reference: we are on MediaWiki version 1.19.1, PHP version 5.3.15, MySQL version 5.0.96-winx64, and the installation is running on Windows Server 2008 R2 x64 (IIS 7.5).
Thanks very much for the help!
You can use local accounts in addition to the LDAP accounts to log users in. You have to set $wgLDAPUseLocal to true in your LocalSettings.php. Basically, it adds another option to the domain drop down box on the login form that says "local". Users that want to log in with a local wiki account use that. I would also disable account creation on the wiki and create accounts manually for your clients.
Regardless of whether you use local accounts or AD accounts, for page-level access control, you would have to use one of these extensions. Extension:AccessControl seems to be a popular one.
Just installed Windows Server 2008 SP2
Installed IIS, ASP.NET and other necessary roles.
For my site folder I edit the permission to include
users: Network Service and a bunch of other IIS user names
a long with that Internet guest one. Fiddled around with the
application pool (Load user profile:True , Identity Network Service etc.
Also only change I made from the default fresh install settings
was installing the .Net 4 framework.
I can view regular html files etc. But should I want to make use of ASP.NET and access an aspx page, I get the following:
403 - Forbidden: Access is denied.
You do not have permission to view this directory or page using the credentials that you supplied.
When running a settings test I get:
The server is configured to use pass-through authentication with a built-in account to access the specified physical path. However, IIS Manager cannot verify whether the built-in account has access. Make sure that the application pool identity has Read access to the physical path. If this server is joined to a domain, and the application pool identity is NetworkService or LocalSystem, verify that \$ has Read access to the physical path. Then test these settings again.
Any ideas?
THanks..
I don't have an answer I know is the solution, but here are my suggestions:
First, have you mapped the IIS default web site to the folder containing your site?
Second, check your basic apppool settings, and make sure it's set to use .Net 2.0. It'll be 2.0 even if you're using a later version, like 4.0.
Barring that, make a new folder in wwwroot and map the default web site to that. Do not mess with the permissions. Then, make a new apppool, don't fiddle with it's settings, and assign that to the default web site. Point here is that you shouldn't have to mess with any of those settings: IIS will take care of that and the permissions.
Final thought, if that doesn't help: check your isapi filter mappings to make sure it knows what to do with .aspx. That should have been set up by default as well, but it's worth a look at that point.
Hi Guys any help would be much appreciated.
We have an application that’s installed at several locations but we are having an issue at one particular site. In short the application settings (My.) are not being saved after a reboot. The application is build in VB.Net v3.5 Framework and we are not experiencing any issues elsewhere.
This particular site is using roaming profiles and the network administrator ensures us that the correct permissions are applied to the user account(s) and all application data is being saved to the server. I’ve asked the network admin to check for the existence of the user settings file user.config in the Application Data directory and he says it doesn’t exist.
In our application we store the connection string to the database in the application settings under the user scope. If no connection string is present or if one is present and a connection to the database cannot be made then a form is shown asking the user for the database credentials. Each morning when the users boot the machine and opens the application for the first time they are asked for these credentials but if they close the application and restart it they are not asked for them. This indicates to us that the settings are being saved but once the pc is rebooted and the application is opened for the first time they are asked for the database credentials. This seems like the settings are not persisting after a reboot.
Any thoughts/feedback would be much appreciated.
I'm wondering if it's Code Access Security preventing the file from being written?
If the sysadmin at trouble site has implemented group policy folder redirection, the user's local/roaming profile could be getting stored on a network fileshare. Code Access Security is fairly picky about letting code read/write to/from network resources.
I'm sorry that I don't have more details than this, and I didn't find any sure-fire hits on google, but searching for "code access security", "fulltrust" and any network/fileshare keywords you can think of may get you farther.
When an ASP.NET application is running under IIS6.0 in Windows 2003 Server with impersonation, what user account is relevant for deciding file read/write/execute access privileges? I have two scenarios where I am trying to understand what access to grant/revoke. I thought the most relevant user is probably the identity specified in the Application Pool, but that doesn't seem to be the whole story.
The first issue concerns executing a local batch file via System.Diagnostics.Process.Start()--I can't do so when the AppPool is set to IWAM_WIN2K3WEB user, but it works fine if it is set to the Network Service identity. I of course made sure that the IWAM user has execute rights on the file.
The second involves writing to a file on the local hard drive--I'd like to be able to prevent doing so via the access control list via folder properties, but even when I set up all users in the folder as "read" (no users/groups with "write" at all), our ASP.NET still writes out the file no problem. How can it if it doesn't have write access?
Google search turns up bits and pieces but never the whole story.
what user account is relevant for [..] file read/write/execute access
As a rule: Always the user account the application/page runs under.
The IWAM account is pretty limited. I don't think it has permissions to start an external process. File access rights are irrelevant at this point.
If a user account (Network Service in your case) owns a file (i.e. has created it), it can do anything to this file, even if not explicitly allowed. Check who owns your file.
Process Monitor from Microsoft is a great tool to track down subtleties like this one.
A bit more searching reveals that the IWAM user isn't that well documented and we should stick with NETWORK SERVICE or a manually-supplied identity if we want to specify permissions for that user.