4

I have an IIS 7 server with a PHP application running on it. This application needs to be able to connect to a network drive that has username and password required. This drive is connected at log in for users with net use \\server /user:. The user is not the logged in user. How can I connect this drive for use in the application?

I have tried changing the app pool to my user but still am denied. I have tried running a batch file with the net use in it as system. I have tried a virtual directory but it did not like the user name that is required. The username contains a \ and . The user is also not a windows recognized user. I do not have control over the network drive just access to it.

  • What is the user if it's not a Windows user? – squillman Jun 20 '14 at 15:36
1

I had a similar problem where I need access to a network share and solved it using the following steps:

1) Create an account with the same username and password on front end server and file server. Make sure that the password does not expire or must be changed.

2) Create a Network Share and give the new account read/write rights. I also tested that I could connect from the front end servers using the new account to verify that no firewalls are in the way.

3) On the front end server, I included the account in the IIS_IUSRS group that indirectly gives it Logon as Batch Job rights.

4) Run the following command to grant rights to the account

aspnet_regiis -ga <your_app_pool_user>

See more: How To: Create a Service Account for an ASP.NET 2.0 Application (MSDN)

5) Restarted WAS and IIS to make sure the changes to the accounts group membership takes hold if tried to use the account.

C:> net stop was /y
C:> net start w3svc

6) Create an Application Pool and set the Identity in Advanced Settings.

This is the part where I got stuck on IIS 8 on Windows Server 2012 with error messages when trying to set the identity.

From IIS Manager I got the following error dialog: "There was an error while performing this operation. Details: Value does not fall within the expected range."

Trying to set the App Pool identity from the command line I receive a similar error:

C:> appcmd set config /section:applicationPools 
     /[name='test-pool'].processModel.identityType:SpecificUser 
     /[name='test-pool'].processModel.userName:MyAccountName 
     /[name='test-pool'].processModel.password:P@ssw0rd

ERROR ( hresult:80070057, message:Failed to commit configuration changes.
  The parameter is incorrect.
 )

When I remove the last parameter, password, the command will succeed changing identity type and setting the username but I did never figure out why I could not set the password so I retorted to editing my applicationHost.config file directly. Unfortunately with the the password ending up in clear text.

<configuration>
   ...
    <system.applicationHost>
        <applicationPools>
            ...
            <add name="test-pool" managedRuntimeVersion="v4.0">
                <processModel identityType="SpecificUser" 
                  userName="MyAccountName" password="P@ssw0rd" />
            </add>
            ...
        </applicationPools>
        ...
    </system.applicationHost>
    ...
</configuration>

7) Finally I set my Web Application to use the application pool and it could access the Network Share without any issues.

0

I would map the network drive using alternate credentials, and then have the PHP application connect to the appropriate drive letter. Keep in mind that if Windows does not have access to a drive, then PHP doesn't, as PHP does not understand Windows Authentication.

  • 1
    A drive mapping will only work for interactive sessions. The PHP app will be running under an IIS worker process and not an interactive session. – squillman Jun 20 '14 at 15:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.