Text version of the video
Slides
All ASP .NET Text Articles
All ASP .NET Slides
All Dot Net and SQL Server Tutorials in English
All Dot Net and SQL Server Tutorials in Arabic
Please watch Part 85, before watching this video. In Part 85, we discussed that IIS provides anonymous access to resources using IUSR account. Once the request is handed over to asp.net, the application code is executed using the application pool identity.
In this video, we will discuss the effects of turning impersonation on, with anonymous access.
To enable impersonation, set impersonate=”true” for the identity element in web.config.
Impersonation can also be enabled or disabled from IIS.
1. Select the web application in IIS
2. Double click on “Authentication” icon
3. Select ASP.NET Impersonation
4. Click “Disable” or “Enable” link under actions in the right hand side panel in IIS.
5. This will automatically change the web.config file.
At this point, if you run the application, you may get an error stating
HTTP Error 500.24 – Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.
To correct this, we need to set the “Managed pipeline mode” of the DefaultAppPool to “Classic”.
Run the application, and notice that, the application code, is now executed, using ‘NT AUTHORITYIUSR’ account, instead of ‘IIS APPPOOLDefaultAppPool’
So, when the application uses anonymous authentication and
1. If IMPERSONATION is disabled, then, the application pool identity is used to execute the application code
2. If IMPERSONATION is enabled, then, ‘NT AUTHORITYIUSR’ account is used to execute the application code
When to use Application Pool Identity over IUSR
If there are 2 or more websites hosted on a machine, with IUSR as the anonymous account, then they can access each other’s content. If we want to isolate, each applications content, the applications can be deployed to different application pools, and the NTFS file permissions can be set for the respective application pool identity. In fact, we have discussed about this in Part 84 – Application pools in IIS Security.
