ASP.NET 3.5 Permissions on IIS 6

Question

I have an ASP.NET page which changes passwords in the OU. Where do I set the user which actually runs my code?

In the virtual directory security settings, the application pool user? or the Webconfig? Which one of the configurations actually configures the user which runs the asp.net code?

Thanks.

Answer 1

You should look into ASP.NET Impersonation. It can be done adding this section to your web.config file:

<identity impersonate="true" userName="accountname" password="password" />

This allows you to control the identity under which code is executed.

_{Important note: It's advisable to understand the implications of this change in terms of security.}