Impersonation NOT working - Network Share

Question

I have created a virtual Directory (IIS 7.0), which points to a network share. This virtual directory resides under my web application root.

I tried using anonymous access with domain credentials. Also, I tried using impersonation as below...

<identity impersonate="true" userName="<supplied username>"
password="<supplied password>" />

ISSUE: Application is always using IUSR to connect to that share and getting "ACCESS DENIED". I need to force my application to Use domain name above.

---

UPDATES
1. While running procmon I can see "FAST IO DISALLOWED" message everytime before access denied. Not really sure if its related.
2. I suspect symptoms of Double Hop Issue here. But don't know how really to validate it or how to get around it without really changing authentication to Kerbros.

Thanks!

Answer 1

With ASP.NET applications it’s usually recommended that you run under the ‘ASP.NET user account’ without impersonation. The idea is that this account is a low rights account that can do little damage if for some reason the machine is compromised.

(Here is a link reference to an article that should help you).

http://west-wind.com/weblog/posts/2153.aspx

Answer 2

I agree with Joe's statement. However, on most enterprise environments, where strict policies are applied, it won't be possible to grant low rights accounts to access certain resources. In that case, programmatic impersonation will be a better approach: http://www.west-wind.com/weblog/posts/1572.aspx

Answer 3

IIS 7 by default runs in integrated mode. You can no-longer impersonate there.

You need to switch the app-pool your application runs in to classic mode.