up vote 0 down vote favorite
share [g+] share [fb]

I have an ASP.NET app on a Windows 2008 server, IIS 7.5.

When I try to access web site, I get a login popup. If I click "cancel" I get a 401 - Unauthorized: Access is denied due to invalid credentials. The app is using Windows authentication (anonymous is disabled).
The app has it's own app pool, running under the App Pool Identity. If I change the app pool to run under the NetworkService account, my website functions just fine.

I'm guessing that this is just a permissions issue, but can't figure out what permissions I need to change.
I gave the App Pool Identity permissions on the physical directory of the app, but that didn't solve the problem.

link|improve this question
feedback

1 Answer

up vote 0 down vote

Granting the app pool identity access to the content should be enough in most cases. Since it still prompts, but doesn't for NetworkService, my guess is that a sub-folder didn't get the new permissions you added, or there is another dependency that the site has to something like the registry.

Try a standard .htm page to confirm that the root of the site works. Double check that the correct app pool identity was granted and that it was granted to the correct path.

link|improve this answer
I verified the permissions, paths, etc., but still didn't solve the issue. However, I was able to find a solution to the problem, but I'm somewhat confused. The App pool identity wasn't a member of the IIS_IUSRS Group. Once I added it, the site worked just fine. Here's the confusing part. I then went back and removed the app pool identify from the group and still works. Even after a server reboot. I thought when iis app pool identities were created, they were automatically in the IIS_IUSRS group. Some sites say yes, others say "at runtime." – Eric Gatesman Mar 29 '11 at 18:47
You're right that the app pool identity is automatically injected into the IIS_IUSRS group at runtime. So your situation sounds like some issue prevented that from working as it should. You may find an answer in Event Viewer, but if it works from now on, I would just consider it a rare exception. If it occurs again, watch for clues in Event Viewer and other patterns. – Scott Forsyth - MVP Mar 29 '11 at 19:42
Will do. Thanks – Eric Gatesman Mar 30 '11 at 19:47
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.