Re: IIS 6 ASP: Which Process Identity Is It Using? App Pool or Anon?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: C K (blah_at_blah.com)
Date: 02/13/04 

Date: Fri, 13 Feb 2004 11:00:45 -0800

Hi,

It is actually not an upload application. When the web application first
starts up, it will launch a COM object method that connects to a remote
server and then sync some information to its local store. This local store
is in the form of some memory mapped files that are located in a data
directory. That is what I find strange. I had thought that either the IUSR
would need the write privileges or that both the IUSR and the TestService
account would need write, but it is actually only the TestService account
that matters.

What actually happens is this: If everything works, the memory mapped files
are created and have the correct data. If I do not give the TestService
account modify/write privileges, then the memory mapped files are created in
the directory, but they have no data in them. The routines to retrieve the
data are in a statically linked dll that I do not maintain, so I do not know
what kind of things it is doing. I just know that generally it connects to
a remote server and retrieves data.

In this case, I do not believe it has to do with the chaching of the user
tokens because after each NTFS permission change, I do an iisreset. I also
have only anonymous authentication enabled as well -- no other auth is
enabled.

Thanks.

""WenJun Zhang[msft]"" <v-wzhang@online.microsoft.com> wrote in message
news:OfEZtvh8DHA.1988@cpmsftngxa07.phx.gbl...
> Hi C K,
>
> As I know, in this kind of scenarios, both process identifier(i.e
> TestService) and thread indentifier(IUSR_machinename) need have write
> permission on the upload folder. I have tested some similar web
> applications as yours - using com dll in ASP pages to upload files
> and the result was coincident.
>
> I doubt if the behavior you met is caused by IIS caches IUSR
> account's token. By default, IIS refreshes this kind of cache every
> 15 mins:
> 152526 Changing the Default Interval for User Tokens in IIS
> http://support.microsoft.com/?id=152526
>
> Recycle the site's application pool or use iisreset to restart IIS to
> test. Also, only enable anonymous access on this site to prevent the
> possiblity of IE auto finishing integreted auth with IIS. Will the
> behavior persist?
>
> Have a nice day,
>
> WenJun Zhang
> Microsoft Online Support
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
> Get Secure! - www.microsoft.com/security
>

Relevant Pages

  • Re: IIS 6 ASP: Which Process Identity Is It Using? App Pool or Anon?
    ... Custom code that ASP runs, like your COM object, ... IIS gives it access to LocalSystem or IWAM (in ... It will now be using "TestService" identity. ... If everything works, the memory mapped files ...
    (microsoft.public.inetserver.iis)
  • Re: IIS 6 ASP: Which Process Identity Is It Using? App Pool or Anon?
    ... and creating the memory mapped files in the data directory. ... impersonated account? ... > IIS ... > would need the write privileges or that both the IUSR and the TestService ...
    (microsoft.public.inetserver.iis)
  • Re: ASPX form Uploads a file even without IIS Write permission
    ... > solely responsible for making your custom configuration secure. ... > authentication/authorization does not lock down everything and leaves the ... IIS simply has no idea whether a given POST request is ... > ASP Upload, what the purpose of the Write IIS property? ...
    (microsoft.public.inetserver.iis.security)
  • RE: User name and password dialog refresh after 3 mins
    ... you are encountering some strange IIS authentication ... Submit the CSV file to server and parsing the file to store data objects ... | 1 User chooses a CSV file to upload ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Upload best practice help !
    ... Make sure no IIS directory has script/executables permission, ... this assumes that you do not have HTTP-accessible script ... if you upload the binary outside of HTTP namespace if you have an HTTP- ... particular environment like inetpub. ...
    (microsoft.public.inetserver.iis.security)