1

I'm setting up a web site in IIS 6.0 and am confused about accounts and permissions. I've got an app pool set up especially for this web site, with a particular user. The Authentication Methods property sheet has the IUSR_XXX account as the anonymous user.

According to this question: In IIS 7.0, what is the difference between the application pool identity and the web site identity?

..the application pool account should be used for file access. But I'm not seeing that behavior. If I only give the web site user account permission to the file system, I get access denied errors. But if I give IUSR_XXX read permission to the files, they'll display.

So what's going on here? Is the behavior different between my IIS 6 and the IIS 7 in that question? Should I ignore the app pool and just change the anonymous user? What's the recommended setup here for a site that will need to access a database and write to certain folders in the file system?

Any help would be much appreciated, thanks!

Improve this question

2 Answers 2

Reset to default
1

The IUSR and the Network Service account are both used by IIS. Here are my recommendations...

  1. For a public website available to everyone:

The IUSR and Network Service need to have Read access to all the application files (.aspx pages etc.) and dlls for the website. The IUSR would need to have Write access to any folder where the website is writing files (this could be dangerous on a public site). The database would be accessed by a SQL or Network account specified in the web.config in the database connection section.

  1. For a website with Forms Authentication (login via a login page using username and password):

Same as above. The Write access to any folder is now better protected because the person using the website has been authenticated by your application.

  1. For a website using Integrated Authentication:

The user credentials of the authenticated user need to have Read access to all the application files (.aspx pages etc.) and dlls for the website. The user credentials of the authenticated user would need to have Write access to any folder where the website is writing files. The database would be accessed by a SQL or Network account specified in the web.config in the database connection section or by the the user credentials of the authenticated user.

Update The Network Service account (or whatever account you are using for your application pool) and the IUSR work together. It is not always 100% clear to me which account is controlling access to which resources but I do know from experience that you need to have both. The IUSR is used for accessing .aspx pages, image files, static content, etc. The Network Service account accesses the IIS metabase, your application dlls, the .Net framework files, etc. Hope this helps.

Improve this answer
1
  • OK, this is going along the right path -- but my question is with your second paragraph -- why would I give BOTH network service AND IUSR access to my files? My understanding was that (assuming no impersonation) the app pool account was used as the user account for the thread, file access permissions, network access permissions, etc. I thought the IUSR account was basically only for within the ASP.NET software to identify the user. Where am I going wrong?
    – Clyde
    Sep 2, 2009 at 15:27
0

From what I've been able to find, this behavior changed between IIS6 and IIS7. In II6 it looks like you cannot have the app pool account be the anonymous user account, directly at least, like you can in II7. I like to use the app pool account for anonymous access in IIS7 but that doesn't work in IIS6 so I need a different setup there.

See this article: http://blogs.iis.net/nitashav/archive/2010/02/15/iis6-0-ui-vs-iis7-x-ui-series-anonymous-authentication.aspx

Apart from the account changes, IIS 7.x also enables designating the Application pool identity as the anonymous user account. This main advantage of using the application pool identity as the anonymous user is that you do not have to manage security for another user account.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .