Web.Config and the Fusion Cache

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Jerry Camel (rlrcstr_at_msn.com)
Date: 03/15/04 

Date: Mon, 15 Mar 2004 12:07:18 -0500

Couple of questions here...

1) What are the security implications of having the plain text password in
web.config for impersonation? There's a warning in the docs regarding the
Impersonation method of WindowsIdentity that says it can only be used on XP
without compromising security. The web server is Win2K, so I decided to go
with impersonation in the web.config, but it seems a plain text password is
also a security risk.

2) From what I read, when you use a specific account for impersonation, that
account must have read/write permissions to the following folders:
    \WINNT\Microsoft.NET\Framework\<version>\Temporary ASP .NET Files
    \WINNT\Assembly

I can change the permissions on the first without a problem, but the second
folder (The global assembly cache.) is of a type called "Fusion Cache" and
does not have a security tab on it's properties page. How can you change
the permissions for this folder?

This all comes about because I need to do some AD queries within my web app
and I need an AD accouont to query with. So I've created an account that
I'm using as a "service" account within the app. Is there a better way to
do this? Thanks.

Jerry

Relevant Pages

  • Re: Win32 security limitations: why?
    ... Impersonation allows a process to run with the credentials ... the Iwam account, for support of the anonymous users. ... this allows the anonymous user to have a process with a higher security ... Microsoft MVP (Windows Security) ...
    (microsoft.public.security)
  • Re: Howto refresh IIS 6 Application pool identity credential info
    ... Only account A has access to database DB-A ... Application A and Application B have an application security based on Active ... The Pool identity is the one accessing the backend resources like ... We are 'investigating' the impersonation alternative. ...
    (microsoft.public.inetserver.iis.security)
  • Re: ASPNET User Problem in Shared Hosting Environment
    ... fine when setting proper security and enabling impersonation, ... I've been able to strip down the rights allocated to the ASPNET account on ... that it's just impersonation and not a separate process. ... the customers we are hosting are not allowed to add stuff ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: newbie : save files not in virtual path
    ... your web app runs under the security context of the ... You can give this account appropriate ... > impersonation. ... > I am a fan of #2, as I use impersonated domain accounts for database ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: newbie : save files not in virtual path
    ... your web app runs under the security context of the ... You can give this account appropriate ... impersonation. ... I am a fan of #2, as I use impersonated domain accounts for database ...
    (microsoft.public.dotnet.languages.csharp)