Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm on IIS6 and asp.net 3.5 SP1.

I decided that my asp.net web application should have a dedicated application pool and a dedicated identity, because this identity is granted access to a sensitive file share that the web application uses. The web application uses integrated windows authentication for the incoming users, and my problem is that when the application pool is set to a dedicated identity, all incoming users fail to authenticate, i.e. the login box (from internet explorer) re-appears after the user submits his password. This problem does not occur when the application pool is set to the NETWORK SERVICE identity.

The dedicated identity has been granted access to the machine's IIS_WPG group and I have tried the following command:

aspnet_regiis.exe -GA myDomain\myDedicatedIdentity

But still no luck. Any suggestions? Any privileges that I forgot to grant to this identity?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I found the solution to my problem: set up an HTTP SPN with the NetBIOS name and the fully qualified domain name (FQDN) of the domain user account that the application pool is running under. Here's the article: http://support.microsoft.com/kb/871179

share|improve this answer

Probably a kerberos issue.

I'd initally try:

cscript adsutil.vbs set w3svc/1/root/NTAuthenticationProviders "NTLM"

Where the 1 is the web site.

Once you've determined if it is Kerberos, you can either continue on NTLM only, or set the SPN's for your site/URL on the Service Account.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.