Setting permission for PHP (or I_USER [I'm not sure here...]) to connect to iisweb.vbs

Question

I have been trying to figure out a way to manage our domains at work and easily created a SimpleDNS class, but now I'm on the IIS Server Administration side of it and I'm just lost on what is going on.

Here is the PHP code I am running to test it.

<?php
$cmd = 'iisweb /create c:\websites\examplesite.com\www "Example Domain!" /d www.examplesite.com';

exec($cmd,$data);
print_r($data);
?>

But when I run it I get:

Array ( [0] => Error &H80041003: Access denied

I am completely stumped on how to set up permissions for this.

Here's the good part! When I run <?php exec('ping google.com',$data);?>: it works seamlessly.

I have no idea where to start when it comes to setting up the permissions for iisweb.vbs (the iisweb vbs file). I don't even know if I'm supposed to set up permissions on that file. I don't know if I'm supposed to setup a CGI option in the console. I'm lost.

Can someone help me out? What am I doing here?

Answer 1

Your code will be running under one of two identities.

1. The identity of the Application Pool that the website runs in (NETWORK SERVICE for example if the defaults were used). You can find this out by opening the property window for an application pool and selecting the Identity tab.

2. The identity of the website anonymous user which you can find in Website Properties -> Directory Security -> Authentication and access control (click the edit button).

FastCGI

If you're running PHP under FastCGI and the c:\php\php.ini configuration value fastcgi.impersonate = 1 then user identity be the site anonymous user (option 2) above. If fastcgi.impersonate = 0 then PHP scripts will execute under the identity of the application pool (option 1).

You can tell if PHP is configured to execute under FastCGI by looking at the .php scriptmap for the site (Website Properties -> Home Directory -> Configuration -> Application Extensions). If it's set to C:\WINDOWS\system32\inetsrv\fcgiext.dll then you're running FastCGI.

No FastCGI

If your .php script map is not configured to use C:\WINDOWS\system32\inetsrv\fcgiext.dll then scripts will run under the identity of the site anonymous user (option 2 above).

In all cases the account used must have Administrators rights to be able to run the IIS admin scripts.