asked on

specify account other than iuser for .asp page?

is it possible to have a .asp page (only one) handled by iis in a different security context than iuser? i want one (only) script on an .asp page to have access to a folder that i have explicitly denied access to the iuser account (ie i want this asp page to operate as a user with higher credentials).

iis 6 on win2k3 server

thanks in advance

ASKER CERTIFIED SOLUTION

mattisflones

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Zyloch

Hi

Ahh, well, just have this in your protected ASP page:

<%
Dim siteBase = "http://www.yourdomain.com/"
If Request.ServerVariables["HTTP_REFERER"] <> siteBase & "yourhigherpermissionpage.asp" Then
Response.Redirect(Request.ServerVariables["HTTP_REFERER"])
End If
%>

Regards,
Zyloch

mattisflones

Or.. just do a include of the page..

mattisflones

Glad i could help! :-)

Dave_Dietz

Though the answer has already been accepted I thought I would post a correction:

You *can* set the anonymous user identity for a single page in IIS. You can set Authentication methods at the page level and this is where you specify the account used for anonymous access (if you are using anonymous).

For this particular question there is no need to create an entire vdir to host a single page, simply change the anonymous user account for that specific page.

Dave Dietz

mattisflones

Dave, how do you do that secure? That would be very interesting to know..