Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.
COURSE of the MONTH
14 days, 22 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
ASP.NET 2010 Impersonation question
Posted on 2013-01-03
I have modified an existing ASP.NET application and for some reason I cannot publish the app. The IIS guy asked me to overwrite the project directory on the server with my updated files. Now, there seems to be a permissions thing because I cannot run the app on the server. I can however run from my local. The question I am being asked now is if I am using impersonation?
This is the email I actually received
"Currently the app is enabled for anonymous authentication, which means every connection is using the local NETWORK SERVICE account, an account that doesn’t have network privileges.
If it’s working, then there is something in the code making it work, probably impersonating a network account."
Anyway, I am very new to asp development so any help would be appreciated.
This is the email I actually received
"Currently the app is enabled for anonymous authentication, which means every connection is using the local NETWORK SERVICE account, an account that doesn’t have network privileges.
If it’s working, then there is something in the code making it work, probably impersonating a network account."
Anyway, I am very new to asp development so any help would be appreciated.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
6
4
2
12 Comments
IIS is assigning a user to your application - by default it's the NETWORK SERVICE account.
You can change it, but how you change it will depend on what you want to do.
You'll make your changes in the web.config file. There are several "right" answers here, so the best thing to do would probably be to read these and then decide which method fits your needs.
http://msdn.microsoft.com/en-us/library/eeyk640h(v=vs.100).aspx
http://msdn.microsoft.com/en-us/library/907hb5w9(v=vs.100).aspx
http://msdn.microsoft.com/en-us/library/9wff0kyh(v=vs.100).aspx
You can change it, but how you change it will depend on what you want to do.
You'll make your changes in the web.config file. There are several "right" answers here, so the best thing to do would probably be to read these and then decide which method fits your needs.
http://msdn.microsoft.com/en-us/library/eeyk640h(v=vs.100).aspx
http://msdn.microsoft.com/en-us/library/907hb5w9(v=vs.100).aspx
http://msdn.microsoft.com/en-us/library/9wff0kyh(v=vs.100).aspx
Active today
Ok I will read the links you provided. FYI, I dont have anything in my web.config that would assign impersonation.
I wanted to let you know the next correspondence I just got:
Question
>>Is there a 'whatever' account/user group? If it’s a user group, please send me the list of people assigned to it.
'whatever' should have access to the shares specified below.
Answer
>>'whatever' is an account and it already has those permissions to the objects.
Forward to me
>>
Can you please check if the application is using that account to get to the shares? I still believe the application is doing impersonation.
Im not sure what to do from here but I will read on...
I wanted to let you know the next correspondence I just got:
Question
>>Is there a 'whatever' account/user group? If it’s a user group, please send me the list of people assigned to it.
'whatever' should have access to the shares specified below.
Answer
>>'whatever' is an account and it already has those permissions to the objects.
Forward to me
>>
Can you please check if the application is using that account to get to the shares? I still believe the application is doing impersonation.
Im not sure what to do from here but I will read on...
Active today
I also wanted to include this. I logged in from my machine, with my username and password, and I got this error when trying to access a file on the network. Keep in mind I can physically go onto the network and open the file? Which leads me to think that I may be I am impersonating?
See image attached
See image attached
Did you log in to the site or debug the site from VS on your machine?
The first would cause this error, the second shouldn't. Anyone who logs into the site will be running the site on the server as the NETWORK SERVICE account unless you configure it otherwise.
So technically YOU aren't impersonating but the application is.
If you debug the site in VS on your local machine, it runs under your credentials.
A couple of quick solutions would be to
give the asp.net NETWORK USER limited rights as an active directory user
or you could use impersonation in your application (in web.config) and run the application as an active directory user who has the proper rights.
Either of those two things should get you up and running.
The first would cause this error, the second shouldn't. Anyone who logs into the site will be running the site on the server as the NETWORK SERVICE account unless you configure it otherwise.
So technically YOU aren't impersonating but the application is.
If you debug the site in VS on your local machine, it runs under your credentials.
A couple of quick solutions would be to
give the asp.net NETWORK USER limited rights as an active directory user
or you could use impersonation in your application (in web.config) and run the application as an active directory user who has the proper rights.
Either of those two things should get you up and running.
I'd expect that you will want to use windows authentication with impersonation with delegation. (So any windows user on your network can access the site, and any resources that you designate).
These links go over set up in detail:
http://msdn.microsoft.com/en-us/library/ff647405.aspx (explains logon types, and setup of web.config)
http://msdn.microsoft.com/en-us/library/ms998351.aspx (explains active directory setup)
They're both worth reading closely, and would be the recommended method.
If you want to just use the NETWORK SERVICES account, then your network admin should be able to get this working by adding the NT AUTHORITY/NETWORK SERVICES account to active directory as a user and then making it part of your user-group (I'm assuming that the access to that directory is granted by user group).
These links go over set up in detail:
http://msdn.microsoft.com/en-us/library/ff647405.aspx (explains logon types, and setup of web.config)
http://msdn.microsoft.com/en-us/library/ms998351.aspx (explains active directory setup)
They're both worth reading closely, and would be the recommended method.
If you want to just use the NETWORK SERVICES account, then your network admin should be able to get this working by adding the NT AUTHORITY/NETWORK SERVICES account to active directory as a user and then making it part of your user-group (I'm assuming that the access to that directory is granted by user group).
Active today
They actually created a group and only users in that group should be allowed to view the app. If thats the case, how do you think this is set up?
They might have done that with Authenticated Access is IIS or just by hosting from a server that not everyone can access.
You still need to get the app to run as a member of that group - right now it isn't. It runs as the default asp.net machine name.
You still need to get the app to run as a member of that group - right now it isn't. It runs as the default asp.net machine name.
Featured Post
We value your feedback.
Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Today is the age of broadband. More and more people are going this route determined to experience the web and it’s multitude of services as quickly and painlessly as possible. Coupled with the move to broadband, people are experiencing the web via …
In .NET 2.0, Microsoft introduced the Web Site. This was the default way to create a web Project in Visual Studio 2005. In Visual Studio 2008, the Web Application has been restored as the default web Project in Visual Studio/.NET 3.x
The Web Si…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you!
In this Micro Tutorial, you'll learn yo…
- Microsoft Applications
- Windows 10
- Windows OS
- Fonts Typography
- Windows 7, Microsoft Word
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
Suggested Courses
Course of the Month14 days, 22 hours left to enroll
771 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.