Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When talking about IIS 7.5 security, AFAIK:

App Pool Identity decides whom my web application runs as.

Authentication Method decides whom the clients are authenticated as.

I have a virtual folder configured like this:

  • I use Anonymous Authentication with the expectation that all clients should be authenticated as IUSR.
  • I give IUSR full control of the folder.
  • My App Pool Identity is set as the XXX account, which doesn't have any permission to the folder. (I intentionally set this)

But it turns out that I cannot browse the files in that folder. Once I give the XXX account permission to access that folder, things goes well.

So what role does the App Pool Identity play in anonymous authentication? It's totally unexpected that I have to give the App Pool Identity account permission to access the folder. I thought Anonymous Authentication would be enough?

Thanks.

share|improve this question
add comment

2 Answers

Lots of overloaded terms here, and a change between IIS 7 and 7.5.

App Pool Identity vs App Pool Account

Let's start with the Application Pool identity (lowercase I, aka App Pool Account):

The way I tell it, the Application Pool Account is the account used to boot an App Pool, and the identity that the App Pool assumes when it's not impersonating anyone else.

So whatever identity you give the App Pool, it's going to need to be able to read the files in the content folder: particularly {but not limited to} any web.config files (which form part of the IIS configuration, and control what the App Pool is going to be doing).

If it can't access a folder, it'll assume there might be an important (game-changing) web.config file in there, and display an error. So the App Pool Account needs Read access to all content folders.

ApplicationPoolIdentity

Why differentiate the App Pool Account (the identity of the app pool) from the App Pool Identity? Because the special-capitals-used ApplicationPoolIdentity is a new account type - a managed service account - introduced and made default in IIS 7.5 / Windows 2008 R2, and available from Windows 2008 SP2 as well (but not the default).

See Application Pool Identities on IIS.Net

When you create a website under R2 using the GUI:

  • an App Pool will be created to host that website, and
  • the account type will be ApplicationPoolIdentity, instead of Network Service (the 2008 default), Local Service or Local System.

With 2008 RTM, the default App Pool account was Network Service plus a unique app pool identity/uniquifier; the new R2/SP2 AppPoolIdentity account type is a Network-Service-like account (i.e. is the computer when connecting off-box), but prevents impersonation of another App Pool within the same box.

Back to the original question:

  • App pool account defines who your app runs as when it's not impersonating anyone else

  • Authentication method describes how you're going to authenticate the clients (in order to impersonate them)

  • The Anonymous user account defines who you're going to run as when impersonating a user for a request which isn't authenticated - IUSR is such a user.

Incidentally, with IIS 7.5, you can set the Anonymous user account to be the Application Pool Identity (properties of the Anonymous authentication method), which might make it more straightforward to isolate and secure the content for a given website.

Set permissions using IIS AppPool\YourSiteName for the name format. (see also this post)

share|improve this answer
add comment

There are two authentication contexts at play. The web server process (that handles your web requests) runs as the App Pool Identity user. When a request comes in for your virtual host, the application pool impersonates the user listed in the specific site's "Anonymous Authentication Credentials" - by default IUSR.

Any scripts run from within your website will run as IUSR, but logging and certain other functions will run as the App Pool User (by default Network Service - although this has been changed recently to use a special virtual app pool user). The App Pool Identity (Network Service) needs to be able to list the files in your directory as certain checks are done in the request stack before control is handed off to your script.

It is good practice to run one site per pool, and set the App Pool Identity to run as the same user as your website's Anonymous user. It is possible to break out of the Anonymous User context (IUSR) and elevate privileges to those of the App Pool Identity itself.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.