Permissions in ASP.NET application

I am not sure what you mean.

<<W2K server, running IIS 6>>
Are you sure?? IIS6 is for Windows 2003

You are right it is IIS 5.

You need to give myfile.aspx permissions for ASPNET or you need to have the app impersonate a user who does have permissions for the app to be able to access the file.

I believe permissions are applied in this order: from first to last (i may be wrong though)
1. File (ACL or NTFS permissions)
2. IIS
3. ASP.NET

You'll need access from each one before to get the next. (you can skip some by not setting them)
So if your using ASP.NET you need to allow the two above it.  It's complicated, and can be confusing...

ZRH

Also, you might want to make sure there isn't any inheritance from super-directories permissions interfereing.
ZRH

Adding the user ASPNET did not have any effect. Adding the user IWAM_SERVERNAME worked but just allows everyone to access the file.

Ok, I read your question more carefully and noticed that the issue is involving the ACL checks.

Adding <identity impersonate="true"/> to your web.config file ought do the trick.  This way the app will use the account specified by IIS using Windows authentication.  It will use that account's file access permissions.  If logged in has/or is in a group that has permission to access the file it will be granted.  The app otherwise will use the anonymous user account that IIS uses (IUSR_MACHINENAME).

This link will shed more light:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconaspnetimpersonation.asp

ZRH

In web.config I have the following:

<authentication mode="Windows" />
<authorization>
  <deny users="?" /> <!-- Deny unauthenticated users -->
</authorization>
<identity impersonate="true"/>

and to recap I have the following permissions on "myfile.aspx":

Creator Owner - Full Control
System - Full Control
mydomain\Administrators - Full Control
mydomain\MyGroup - Read, Read/Execute
mydomain\ASPNET - Read, Read/Execute

Now when I attempt to access the page I am not prompted for the login and I get the error below:


Server Error in '/Apps' Application.
--------------------------------------------------------------------------------

Access is denied.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.ApplicationException: Access is denied.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.  

Stack Trace:


[ApplicationException: Access is denied.
]
   System.Security.Principal.WindowsIdentity._ResolveIdentity(IntPtr userToken) +0
   System.Security.Principal.WindowsIdentity.get_Name() +71
   System.Web.Configuration.AuthorizationConfigRule.IsUserAllowed(IPrincipal user, String verb) +100
   System.Web.Configuration.AuthorizationConfig.IsUserAllowed(IPrincipal user, String verb) +81
   System.Web.Security.UrlAuthorizationModule.OnEnter(Object source, EventArgs eventArgs) +178
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute() +60
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +87

 

By the way, you can avoid all these permission settings if you want by just doing some programattic checking in the .aspx file.

i.e)
Set permissions like all other files...
then:
In Page_Load event.

WindowsPrincipal principal = (WindowsPrincipal)Thread.CurrentPrincipal;
if(!principal.IsInRole("MyGroup") && !principal.IsInRole("Administrators")) {
    Request.Redirect("./access_denied.aspx");
}

ZRH

Ok here is what I now know based on some pointers from ZRH. These are the steps I had to take to enable selective access to files using Windows as the authentication format. I chose this format because the management of users and files is already in place and it does not require yet another username and password combination to be remembered.

Keep in mind my configuration included a W2K server, IIS 5, and Active Directory services with the web server also acting as a Domain Controller. So, having said that, to control access to a file or directory with W2K and IIS5 when accessed via a web browser you must do the following:

In IIS Management Console set the "Authentication" method to whatever level you prefer. This can be done for the folder or virtual directory as well as individual files. In my case I wish to allow some files to be accessed by everyone so I have enabled both "Anonymous Access" for this purpose and under "Authenticated Access" I have enabled "Integrated Windows authentication". This allows further access control using NTFS file permissions. The most restrictive permissions will apply. Enabling "Anonymous Access" will not allow an unauthenticated user or user without proper credentials to access a resource for which he has not been given access rights through NTFS permissions. As a side note my installation used the IUSR_machinename as the Anonymous User account and the checkbox was enabled to allow IIS to manage the password. Close IIS Management Console.

In Windows Explorer right-click on the file or folder that you wish to change permissions for. Add or remove groups and users as needed and change permissions for these groups and users. I have found that the following accounts must be added regardless of the other settings and have found documentation that seems to support this:

Creator Owner - Full Control
System - Full Control
domainname\ASPNET - Read, Read/Execute
domainname\IWAM_machinename - Read, Read/Execute

and any other accounts you wish to have access this resource. Close Windows Explorer.

Once this has been accomplished go to Start&#61664;Program Files&#61664;Administrative Tools and open the Domain Controller Security Policy. Once inside the Domain Controller Security Policy Console go to Windows Settings&#61664;Security Settings&#61664;Local Policies&#61664;User Rights Assignments. In the right hand pane double-click on "Impersonate a client after authentication". Enable the "Define these policy settings" checkbox and click "Add". Click "Browse" then find and select the account IWAM_machinename and click OK&#61664;OK&#61664;OK. Close the Domain Controller Security Policy Console.

At a command prompt issue the following command:

secedit /refreshpolicy machine_policy /enforce

then at the command prompt issue the following command:

iisreset

Close the command prompt window. Now we need to modify the web.config file for the ASP.NET application as follows:

<authentication mode="Windows" />
<authorization>
  <allow users="*" /> <!-- This allows all users to access even if they are outside the domain provided NTFS permissions allow it and IIS allows "Anonymous Access" -->
</authorization>
<identity impersonate="true"/> <!-- This allows ASP.NET to impersonate the user requesting a restricted resource after authentication has taken place. It requires that an account be specified for the impersonation on the macine hosting the ASP.NET application -->

Save the file and check for proper operation of the web site pages you have modified the permissions for. If anyone notices inaccuracies in document please feel free to make corrections and thanks again to ZRH.

Here are some external resources I used:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q815171#4
http://4guysfromrolla.411asp.net/
http://www.jsiinc.com/SUBN/tip6900/rh6981.htm

Ok here is what I now know based on some pointers from ZRH. These are the steps I had to take to enable selective access to files using Windows as the authentication format. I chose this format because the management of users and files is already in place and it does not require yet another username and password combination to be remembered.

Keep in mind my configuration included a W2K server, IIS 5, and Active Directory services with the web server also acting as a Domain Controller. So, having said that, to control access to a file or directory with W2K and IIS5 when accessed via a web browser you must do the following:

In IIS Management Console set the "Authentication" method to whatever level you prefer. This can be done for the folder or virtual directory as well as individual files. In my case I wish to allow some files to be accessed by everyone so I have enabled both "Anonymous Access" for this purpose and under "Authenticated Access" I have enabled "Integrated Windows authentication". This allows further access control using NTFS file permissions. The most restrictive permissions will apply. Enabling "Anonymous Access" will not allow an unauthenticated user or user without proper credentials to access a resource for which he has not been given access rights through NTFS permissions. As a side note my installation used the IUSR_machinename as the Anonymous User account and the checkbox was enabled to allow IIS to manage the password. Close IIS Management Console.

In Windows Explorer right-click on the file or folder that you wish to change permissions for. Add or remove groups and users as needed and change permissions for these groups and users. I have found that the following accounts must be added regardless of the other settings and have found documentation that seems to support this:

Creator Owner - Full Control
System - Full Control
domainname\ASPNET - Read, Read/Execute
domainname\IWAM_machinename - Read, Read/Execute

and any other accounts you wish to have access this resource. Close Windows Explorer.

Once this has been accomplished go to Start-->Program Files-->Administrative Tools and open the Domain Controller Security Policy. Once inside the Domain Controller Security Policy Console go to Windows Settings-->Security Settings-->Local Policies-->User Rights Assignments. In the right hand pane double-click on "Impersonate a client after authentication". Enable the "Define these policy settings" checkbox and click "Add". Click "Browse" then find and select the account IWAM_machinename and click OK-->OK-->OK. Close the Domain Controller Security Policy Console.

At a command prompt issue the following command:

secedit /refreshpolicy machine_policy /enforce

then at the command prompt issue the following command:

iisreset

Close the command prompt window. Now we need to modify the web.config file for the ASP.NET application as follows:

<authentication mode="Windows" />
<authorization>
  <allow users="*" /> <!-- This allows all users to access even if they are outside the domain provided NTFS permissions allow it and IIS allows "Anonymous Access" -->
</authorization>
<identity impersonate="true"/> <!-- This allows ASP.NET to impersonate the user requesting a restricted resource after authentication has taken place. It requires that an account be specified for the impersonation on the macine hosting the ASP.NET application -->

Save the file and check for proper operation of the web site pages you have modified the permissions for. If anyone notices inaccuracies in document please feel free to make corrections and thanks again to ZRH.

Here are some external resources I used:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q815171#4
http://4guysfromrolla.411asp.net/
http://www.jsiinc.com/SUBN/tip6900/rh6981.htm