Uploading files across domains in ASP.NET

Question

Having a little trouble and i wanted to see what you'd all suggest. Thanks for your input.

We have an ASP.NET website, one feature is that this website will allow users to upload files and then the server saves them to a UNC path.

Some of our users cannot upload the files. I think this would likely be security issues as these users are in a different domain and therefore cannot access the UNC path to where the system is trying to save the file.

The web site uses Windows authentication to validate users. The file server and the webserver are 2 separate machines but are located within one domain the users are coming from another domain

the system is using System.Web.HttpPostedFile.SaveAs(String SaveLocation) to save the file

what i can't figure out is why the file is not being saved using the AppPool's settings and how to configure this to not try to use the client credentials to save the files.

EDIT: I thought if it was controlled by the app pool than ALL of our users would be having troubles. but it seems to just be the ones outside the domain that has the fileserver.

Any thoughts?

Thanks for the insight.

Answer 1

Do you have <identity impersonate="true" /> in your web.config?

If so, you're using your client user credential to save that file; in this case, probably will be better if you could use just you application pool account and grant it with proper file system permissions.

You can define credentials this way:

<identity impersonate="true" 
          userName="domain\username"
          password="password"/>

Answer 2

You could try configuring a fixed identity in the Appllication Pool settings that has sufficient permissions to write to the UNC share.

Answer 3

In IIS under Properties-->Directory Security-->Authentication Access and Control In the "Enable Anonymous Access" box, change the username to a domain account with access rights

to elaborate, the app pool is the account the process runs under, the "Authentication Access and Control" account is the username the anonymous users are actually running as. This would make sense as your domain users (probably using Integrated Authentication) already have access.

EDIT Here is a pretty image too: