IIS WebServer CreatesNew file: OwnerShip?

Question

IIS is configured for Integrated Windows Authentication.

web.config is configured as follows:

<authentication mode="Windows" />
<identity impersonate="true" />

We are Load balancing between \webserver1 and \webserver2.

Windows Server 2003

1. \\webserverX creates a XML file to \\share1 and access is denied.

2. We got pass through access denial by allowing Everyon to access the share...

3. We would like to have the impersonated user to be the owner of the created file. Instead, \\webserver1's computer account is the owner.

4. How can we make sure that the impersonated user has ownership of the file at creation time?

PROGRESSION:

1. I decided to create the file locally on \\webserver1's root directory.

2. File's ownership is NETWORK SERVICES even if impersonate="true".

3. I'm unable to change ownership of the file in C# code.

Why when creating a file, IIS won't use the impersonated user's write permissions? If it actually does, what I am doing wrong?

Answer 1

Alright people,

The write permissions and ownership used when creating a file is ASP.NET, a local account!!!

1. Substitute that account by a network AD account.

2. Give permissions to that account on the necessary shares.

That account will be the owner of the files created localy and remotely.

Impersonation at the process level is impossible as far as I know...

Answer 2

Alternatively you can force impersonate to use a fixed account, ie:

<identity impersonate="true" userName="domain\user" password="password" />

This way you don't need to make any changes to your IIS configuration.

Answer 3

Looks like the application pool's identity is used to create the file (it is by default NETWORK SERVICE); try changing that and see what happens.

Maybe this can help you: http://msdn.microsoft.com/en-us/library/ms998351.aspx.