Writing to a network location in ASP.NET (using AD)

Question

Hey guys,

I'm running into a (hopefully) small issue. I have a web app written in ASP.NET, that will be running off of a Windows 2003 Server machine using IIS 6.0. When I run it locally, it works perfect. When I run it from the server, the site works fine. The issue lies in writing to a remote folder. I have a network folder using AD permissions that the application writes to. With my AD account (when I write it locally) it authenticates properly, but when using the IIS account it does not. Has anyone come across this? Any solutions available?

So far, I've tried using my AD account as the "Guest Account" in IIS that the site runs off of, but that still didn't work.

Any thoughts, explanations, or suggestions would be greatly appreciated!

Thanks.

Answer 1

Might it be related to the account that the Application Pool is running under?

Answer 2

By default ASP.NET runs under the context of a local user account, which will not have access to your AD machines. You can reconfigure the connection pool to run as a domain account and lo, it gets access. You should give the domain account as little privileges as possible, and add it to the IIS_WPG on the IIS machine and give it Run as service rights on that box.

Answer 3

You might also consider doing as suggested in this SO answer:

http://stackoverflow.com/questions/1411013/asp-net-windows-authentication-impersonate-problem

Wrap the code that is doing the writing to a remote location and everything else could be left alone. This will give you the best security for the web app since you are only impersonating an account with these writes for the code that needs it instead of all of it.

Answer 4

The way I normally tackle these situations is to do a couple of steps.

• In AD create an account for the service.
• Add this account to the network share you wish to access.
• Then have your ASP.Net application run using that service account instead of the local IIS account.

• In your web.config file you put the following line under

  <system.web>
 <identity impersonate="true"/>
</system.web>