IIS 7, Integrated App Pool, Identity set to NetworkService
We've recently moved an asp.net MVC 3 to our production environment. The application uses windows authentication. The production environment is setup on a web farm on IIS 7, running Win 2008 (not sure if R2). There are two servers configured to run the web application.
We've had on two occasions (about 1 week apart) where users are getting authenticated as different users than themselves. Checking the IIS logs, it seems like after some point, all requests are authenticated as one particular user. In the log there are also entries with X-ARR-LOG which is apparently Application Request Routing Module (not sure if related, but more info could be helpful..). My networking background is not very strong, but our networking resources haven't had any luck finding the issue.
Are there any diagnostics tools we can run to see where the issue may be coming from? Is it likely that something is configured incorrectly on the web farm that could be causing this problem?
One important factor is that in the IIS log, there are requests for a plain html page that doesn't go through the asp.net pipeline, and in the log that entry is requested under the user mentioned above. So it seems like after the problem comes up, all requests seem to be authenticated under the same user account.
Appreciate any help, hints that you can provide
Update:
Elaborating on how we are making the determination that different users are getting authenticated as one user...
In the IIS Log, we are looking at the cs-username column which according to the documentation, is set by IIS. We can see different requests from different IPs, in different locations that have the same cs-username. In the log, all the requests have different cs-username until all of a sudden, all requests are from the same cs-username. We've been able to reset this problem by taking the servers out of the farm and recycling the app pool. Not sure specifically which of those two helped us "reset" the problem. Also mentioned that some of the requests are for a plain html page, that doesn't go through the asp.net pipeline, (believe it is used by a monitoring tool, as it is called sitecheck.html) and those requests abruptly have the same cs-username. Also, the application itself uses the WindowsIdentity to display user specific data, which is what led us to look into the problem a little deeper...