The ability of a web application running under IIS 4.0 to access resources on other servers is heavily dependent on the security context under which the application is running: it is not always obvious which IIS settings and conditions enable or prohibit network access. In this article, we'll investigate the influence of the different levels of security settings on a simple ASP application which tries to access a file on a network share.
Authentication and Impersonation When you send an HTTP request to an IIS server, it will first try to figure out who you are i.e. authenticate you and then assume your identity i.e. impersonate you. From the security perspective, all server activities triggered by your request are then treated as if you were actually logged on to the servers console screen. By using this approach, IIS can benefit from the native NT security and protection features without having to provide its own security functions. Three major variations of authentication are currently used in IIS 4.0 and can be configured with the Internet Service Manager. They operate as follows: Anonymous : The server does not care about the user's identity and simply uses a pre-specified default account. By default, this is the IUSR_MachineName account. Basic Authentication : The user sends username and password unencrypted to the server. The server will then contact the appropriate security authority - typically an NT domain controller - to verify the account. NB. The user id can either be declared simply, eg Mobius, fully qualified, eg DomainName/Mobius, or in IIS5.0 in the form mobius@DomainName.com. NT Challenge/Response Authentication : When challenged for user information by the server (IIS), the client responds with an encrypted security blob which an NT account (possibly domain controller, possibly local account) has previously issued. The blob contains just enough information to let the IIS server know who the user is and that it is safe to assume this identity. IIS does not receive the user's password. As long as only the local resources of the physical IIS server box are used, all of the authentication methods work equally well. IIS and the operating system work hand-in-hand to grant or deny access in an easily predictable manner. When it comes to accessing resources on other servers, particularly from ASP pages however, the authentication method used to deny or grant access becomes a critical step in the process. In the remainder of this article, we will investigate the related IIS parameter settings.
Author(s): Ulrich Schwanitz
Related items:
Some other article
Interesting article from our article base
(James Britt,
Teun Duynstee)