IIS 7 impersonation and identities

Question

I'm trying to get used to II7, having worked with IIS6 for quite some time.

In IIS 6, I'd set <identity impersonate="true"/> in the web.config, and make sure that I applied the correct NTFS permissions to the IUSR_[MACHINENAME] account if a folder required more than read permissions.

In IIS 7, I'm having trouble duplicating this setup without resorting to applying too many permissions.

If I use <identity impersonate="true"/> in IIS 7, Environment.Username tells me that I'm indeed impersonating the IUSR account, which is the new equivalent. However, if I log into the admin portion of the website using forms authentication it impersonates differently than I expect.

With NetworkService set in the application pool:

• not logged in: IUSR, not impersonating: [MACHINENAME]$
• logged in: [MACHINENAME]$, not impersonating: [MACHINENAME]$

With LocalService set in the application pool:

• not logged in: IUSR, not imperonating: LOCAL SERVICE
• logged in: LOCAL SERVICE, not impersonating: LOCAL SERVICE

If I give the IIS_IUSRS account the NTFS permissions I can make things work just fine, but this seems odd. How can I always impersonate the IUSR account? Or, am I supposed to give the NTFS permissions to IIS_IUSRS?

I'd appreciate a good explanation of this change in IIS7 - I've searched around and can't find an explanation for this usage with forms authentication.

Answer 1

The pipeline changes in IIS 7 handle authentication very differently than previous versions. Most scenarios are just as possible, but the setup is different.

You should look at this entry on "breaking changes" in IIS 7.0 It should help you narrow down to what's happening

http://learn.iis.net/page.aspx/381/aspnet-20-breaking-changes-on-iis-70/

Hope that helps

Answer 2

Here's a snippet from a technet article:

If you enable impersonation for an ASP.NET application, that application can run in one of two different contexts: either as the user authenticated by IIS 7 or as an arbitrary account that you set up. For example, if you were using Anonymous authentication and chose to run the ASP.NET application as the authenticated user, the application would run under an account set up for anonymous users (typically, IUSR). Likewise, if you chose to run the application under an arbitrary account, it would run under whatever security context was set up for that account.

Here is the full document:

http://technet.microsoft.com/en-us/library/cc730708%28WS.10%29.aspx