0

I have created a virtual Directory (IIS 7.0), which points to a network share. This virtual directory resides under my web application root.

I tried using anonymous access with domain credentials. Also, I tried using impersonation as below...

<identity impersonate="true" userName="<supplied username>"
password="<supplied password>" />

ISSUE: Application is always using IUSR to connect to that share and getting "ACCESS DENIED". I need to force my application to Use domain name above.

UPDATES
1. While running procmon I can see "FAST IO DISALLOWED" message everytime before access denied. Not really sure if its related.
2. I suspect symptoms of Double Hop Issue here. But don't know how really to validate it or how to get around it without really changing authentication to Kerbros.

Thanks!

Improve this question

1 Answer 1

Reset to default
1

First of all, "impersonation" is the term applied only inside the same machine, if your network share (or IIS, or virtual dir, or MS SQL Server, etc.) is on another computer then it is delegation and you should configure it between computers (read SPN, Service Principal Name).
Are your network share on the same or on the different computer?

Then, it is not "double hop" since you do not pass-through original identity of your webapp user but use fixed impersonation in web.config.

I hope it is not in production? This, putting credentials in web.config, is EVIL, EVIL, EVIL, do not ever do this, just don't!

BTW, you can reach the same result without fixed impersonation in web.config by running your webapp in custom application pool under your domain user, cf. [1]. This is more easy, configurable and reliable.

I could have tried to write you instructions for all possible cases since the exact context is blurred in your post but it would have ended up in unreadable dozens-page article.

OK, I started writing:

  • Disable "Anonymous access" and enable "Basic authentication" in IIS (properties of website)
    Change 

    <authentication mode="None" />

    to 

    <authentication mode="Windows" />

    in web.config

    Disable "Use simple file sharing" in Windows Explorer --> menu Tools ---> Folder Options... ---> tab View

    Give permissions for username on network share

    Make sure that NTLM is enabled on all involved interacting computers

Plz read and follow instructions in [2].
I could not find the description of the same quality for IIS7/W2006 but I strongly believe what you need did not change.
If you would have any further questions or problems, post more specific questions.

----- Cited:

[1]
How To: Create a Service Account for an ASP.NET 2.0 Application
http://msdn.microsoft.com/en-us/library/ms998297.aspx

[2]
How To: Use Impersonation and Delegation in ASP.NET 2.0
http://msdn.microsoft.com/en-us/library/ff647404.aspx

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .