Re: IIS application pool identities and ASP.NET

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 05/22/04 

Date: Fri, 21 May 2004 17:06:15 -0700

This is not really a question for IIS. I suggest you ask an ASP.Net forum.

IIS has handed control to ASP.Net when your ASP.Net code executes, giving it
a process identity of Network Service and thread identity of IUSR -- and if
ASP.Net chose to call RevertToSelf prior to executing any code, that is an
ASP.Net behavior.

In other words, I suspect you have anonymous access enabled in IIS and that
you had ASP.Net's "identity" section configured to "impersonate". This
would lead you to first see IUSR_machinename inside your ASP.Net code, and
when you subsequently changed the thread token to Administrator, that also
worked. However, you're saying that when you then CoCreateInstance on the
DLL from managed code, it does so using process identity. Something has
called RevertToSelf, and it wasn't IIS... 

-- 
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Peter Johansen" <peterJohan13384SPAMSUCKS@hotmail.com> wrote in message
news:Pmtrc.101655$0qd.58978@twister01.bloor.is.net.cable.rogers.com...
Hi, I posted this question in ASP.NET newsgroup but later thought it may be
more relevant to this group. If anyone can shed some light on this for me
I'd appreciate it.
----------------------------------------------------------------------------
I'm trying to figure out a simple problem but I'm stumped. I have an
application that needs to access a .dll that (for security reasons) only
grants permissions to the Administrators group. Since the application pool's
identity is the default "Network Service", I was thinking I'll just
impersonate the "Administrator" account in my ASP.NET code.
Now, when I check the value of "WindowsIdentity.GetCurrent().Name" BEFORE
the identity switch it reports the identity as that of the anonymous
"MACHINE\IUSR_machine" account. When I check the same value right AFTER the
switch it reports "MACHINE\Administrator". So the identity switch seems to
be successful.
However, when I try to access the .dll right after that, I get the "Can't
create ActiveX object" error. That's because when I check access to the .dll
with FileMon it reports that it's still trying to access the .dll as the
"Network Service" user!
What am I missing? Why is it using the identoty of the application pool, and
NOT the impersonated identity for access to the .dll?
Thanks for any help!
----------------------------------------------------------------------------

Relevant Pages

  • Re: IIS application pool identities and ASP.NET
    ... > This is not really a question for IIS. ... > DLL from managed code, it does so using process identity. ... > the identity switch it reports the identity as that of the anonymous ...
    (microsoft.public.inetserver.iis)
  • Many, many thanks
    ... Assuming that you instantiate the object in the dll on a .asp page, ... if you want to keep a dll loaded in IIS you have a couple ... my ole server dll was exposed. ...
    (microsoft.public.inetserver.iis)
  • Re: Accessing 32 bit COM components in 64 bit IIS
    ... we will be introducing the ability to configure IIS to run under ... and under the 32bit command line no error is thrown. ... the problem must be to do with how the dll is registered. ... > You should be able to reproduce your situation outside of ASP by creating ...
    (microsoft.public.inetserver.iis)
  • Re: Fail to create IXSSO.Query object
    ... There is no 64-bit Jet driver, so you've got no choice but to use 32-bit ... Can you switch IIS back to 64-bit mode and see if that then works? ... I also will try to register the dll again. ...
    (microsoft.public.inetserver.asp.general)
  • Re: Calling unmanaged code from ASP.NET in IIS7
    ... Did you restart IIS after making changes to the security settings. ... Without the actual DLL, ... It works on my dev box if I run the website through Visual Studio using ... Strange thing is if I try to reference a system dll, ...
    (microsoft.public.inetserver.iis)