IIS 6.0 permission issue

Question

I am confused about the differences between two accounts,

• the Windows account which the appication pool will run on;
• the related mapped Windows account when we use anonymous access to a web application to IIS.

What are the differences?

I am using Windows Server 2003 x64 + IIS 6.0.

thanks in advance, George

Answer 1

It is somewhat confusing isn't it. First, the anonymous access account has been around for ages, the idea of applicaiton pools is new in IIS 6. I think (although I have no evidence) that if IIS was being designed from scratch now, this isn't how it would be setup, it feels like it is just preserving compatability.

The application pool account requires certain permissions on the server. These are normally granted by adding the account to the IIS_WPG local group.
The anonymous access account doesn't require these permissions.
Assuming that your website is setup to allow anonymous access, then what account your page runs as will be determined by the impersonate setting of the web application. If impersonate is on then the request will be processed as the anonymous account. On the other hand, if impersonate is turned off, then the request will run as the application pool account, regardless of the authentication settings.
If you don't need impersonation then you will get slightly better throughput if you turn it off. I also think it is easier to follow if the page request runs as the application pool rather than having yet another account involved in the process.

I have written some small web applications for a corporate intranet. These tend to use windows authentication, so that ASP knows who is accessing the page, but don't impersonate, so the request runs as the application pool. This allows database access to run as a windows account which makes administration easier (IMO) and keeps our DBAs happy.
The one site that doesn't need to know who is running it, turns on anonymous access but leaves impersonation turned off.

EDIT: Further reading.
A quick search MSDN found this article which might help. I also found these two articles about how things have changed in IIS 7.
They seem to support my theory that the anonymous access account isn't really required now IIS supports application pools.

EDIT: About impersonation
ASP.NET will use settings from machine.config if there isn't a setting in the web.config. More information on how the various config files interact is here

Answer 2

I'm a new user and don't have enough reputation points to comment so hopefully replying like this is fine. Great discussion. I thought I would insert a couple comments.

pipTheGeek, as you pointed out, this is much nicer in IIS7. You can set the site to always just use the app pool identity. Then you don't need to maintain 2 users anymore. This is great when you have 1 site per app pool, or all sites in the same app pool trust each other.

IIS_ WPG (without the space. This text sequence makes it italicized) is a requirement and isn't a consideration for impersonation. In IIS6, if you don't add a user to the IIS_ WPG group, it cannot be used as the identity of an app pool. The app pool will fail on the first attempt to use it. In IIS7, the user is injected into IIS_ WPG automatically so you don't need to worry about it anymore.

In terms of impersonation, it's not followed 100%, so you will always need at least read permissions for both the app pool identity and the anonymous or authenticated user. For example, if you use windows auth for your SQL Server connection string, it will always RevertToSelf and use the app pool identity rather than the anonymous (or authenticated) user's identity.

George, to confirm if you have impersonation set, use processmonitor from www.sysinternals.com. With that you can see what is being used on disk, and the properties of a line will show you if it impersonated or not. That's a free tool, safe on a production server and easy enough to learn.

Impersonation isn't enabled by default so if you don't see it in your web.config, it's probably not yet. However, if you're not the server admin, check the root web.config and machine.config too, in the framework\config folder, to confirm that it's not set there. Search for the word 'impersonate'.

Another side, whenever you see docs that talk about the ASPNET user, consider them old and for IIS5. What it really means in IIS6,7 is the app pool identity user.