0

In IIS 6 I was able to use the following technique:

  • Turn on requirement for client certificates
  • Using adsutil.vbs figure out what IUSR_Server user password is
  • Create a one-to-one mapping of the certificate to the IUSR_Server account (that's why I need to know IUSR's password)
  • Disable anonymous access to the site

Taking into account all the breaking changes in IIS 7.x, I assume that client certificate mapping now has to be created to the ApplicationPoolIdentity? In any case: to create a mapping, I need to specify userName and password, however for both IUSR and ApplicationPoolIdentity passwords don't seem to exist?

My goal is to prevent access to the site without a particular client certificate. At the same time I do not want to create a separate Windows user, configure the AppPool to use it for identity, and then set up one-to-one certificate mapping to this user. Instead, I want to rely on the existing identities offered by IIS. Any ideas?

1 Answer 1

1

The ApplicationPoolIdentity is seen as COMPUTERNAME$ across the network, and it's a virtual account so it doesn't have a password. I don't believe this will work for your mappings.

At the same time I do not want to create a separate Windows user, configure the AppPool to use it for identity, and then set up one-to-one certificate mapping to this user.

Why don't you want to use this method? That's probably your best bet. In IIS7 you don't need to add the user to the IIS_WPG group. Just create a user+password that you manage and add to the app pool.

Also, for your authentication/anonymous setting, set it to use the app pool identity. Then you don't need to worry about the IUSR anymore. As long as you give each site its own app pool, or sites trust each other, then you can use this method and have one less user to manage.

1
  • What I wanted to emphasize in my question is that I am not very keen on creating an additional Windows user. Having failed in my attempts to reuse AppPoolIdentity virtual user, I believe there is nothing else left but to make a real user. I suspected that the virtual user won't work, but was not sure. Thank you very much for confirming this.
    – haltenberg
    May 6, 2011 at 4:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .