0

My Application users are getting http 401. error when they try to browser to my application.

My app is a intranet Web Application which uses Windows Authentication. Anonymous authentication and Identity impersonation are disabled. A separate application pool is created and assigned to the website. IIS ApplicationPool\myApplnAppPool is given read & execute permission on the application root folder.

I verified the worker process (w3wp.exe) and it is running under the Application pool identity in the task manager on the server.

When I give Everyone (Everyone Domain group) Access on my websites folder they are able to access the application. However I believe that is not the right practice of giving EveryOne group access on the folder level.

Also e my app creates & updates a application log file (under the application root folder).

Any help on this will be highly appreciated. Thx.

Improve this question

2 Answers 2

Reset to default
1

It depends on what you are using the application for and how its authentication works. If the application requires the user's credentials to actually do anything, giving everyone (that being everyone in your domain, excluding guests) access may not be a bad idea at all.

If you do want to restrict access to specific people, the best practice is to create a group and give them the required access (probably read/execute). You could also ensure the group is denied access to configuration files, for instance, and create a "support" group for that application as well that has more access.

In the end, whatever credentials are being used (anonymous auth really just impersonates some specific account you provide for that purpose) need to have read and possibly execute and traverse permissions in the filesystem to access the website.

From your comment above, if you do need to know which specific domain users are accessing it, definitely keep anonymous auth disabled, but if you don't need to limit access to a subset of domain users, there is no harm in granting access to the domain everyone.

Improve this answer
1
  • Thanks Falcon. Yes I certainly need to give access to everyone in my domain access to the app & then based on there info in our hr system I either restrict them or authorize them further on my application. So do I need to give the IIS Apppool\myApplnAppPool permission on my web application folder at all? I tried removing it and still the app works (with everyone granted), so I'm wondering if I can remove the app pool from the folder permission, since it does seem to getting used. And yes I need their ADS name only and nothing more to do or access anything on server.
    – Milan
    Apr 13, 2012 at 6:41
0

By enabling windows auth and disabling anon, you've basically saying "in order to access my web site, you must have access or you're not getting in". Even though the app pool has access, you're blocking it at the web site level. That's why it works when you give everyone access. It sounds like you want an anon site, and let the app its self determine what permissions someone has.

Improve this answer
2
  • Eric - So are you suggesting I should be having both Anonymous authentication & windows authentication turned on and run the anonymous auth with the appln pool account? My requirement is that I want to authorize all domain users and also identify them in my application, any non domain user should not have access to the appln.
    – Milan
    Apr 12, 2012 at 18:08
  • then i would grant "domain users" or if you have a custom group that has all your users, use that one with Windows Auth. In your case you shouldn't need anon then. See if that works.
    – Eric C. Singer
    Apr 12, 2012 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .